2f04d538a22ae4008e7090aa04063f8a014f12fb1acb51d57bfd94855394f09b

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
Size

468KB
MD5

03fa0ada38c1bbaa52bac2f7d07a6b90
SHA1

49d3e114f5c652d33ae3078e6c72842f6e80259b
SHA256

2f04d538a22ae4008e7090aa04063f8a014f12fb1acb51d57bfd94855394f09b
SHA512

45c795fc4b3ea25bc6fc8171624a34727674af1149c2c35cf64a7667479f2678bcfe7b3f48db9da3c3867bbb4b8f30bc6c247ab90768c3f2c279c96aa3ec37b5
SSDEEP

3072:iOAoogIdId5CtbYiYztjcf8/ICtvPTpShmHeLVUiAO78Q/9PBnlx:iObowbCtNYJjcfWNixAOoW9PB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3044	Unicorn-60630.exe
2580	Unicorn-17299.exe
1752	Unicorn-45098.exe
2904	Unicorn-59421.exe
2888	Unicorn-47916.exe
2652	Unicorn-51445.exe
2872	Unicorn-12834.exe
2660	Unicorn-37639.exe
944	Unicorn-21172.exe
1708	Unicorn-42766.exe
592	Unicorn-59294.exe
1972	Unicorn-53164.exe
2036	Unicorn-51126.exe
1056	Unicorn-39428.exe
2948	Unicorn-26357.exe
1604	Unicorn-51640.exe
2444	Unicorn-7270.exe
1280	Unicorn-47430.exe
1720	Unicorn-53560.exe
856	Unicorn-52107.exe
352	Unicorn-11266.exe
1744	Unicorn-21163.exe
1728	Unicorn-1297.exe
2796	Unicorn-20897.exe
2360	Unicorn-62195.exe
2056	Unicorn-53649.exe
2172	Unicorn-56449.exe
2476	Unicorn-62579.exe
3020	Unicorn-42713.exe
2736	Unicorn-22829.exe
2724	Unicorn-22829.exe
2784	Unicorn-9787.exe
2884	Unicorn-29388.exe
2668	Unicorn-29653.exe
704	Unicorn-40051.exe
1536	Unicorn-46181.exe
1868	Unicorn-28427.exe
2588	Unicorn-48293.exe
1624	Unicorn-28619.exe
1712	Unicorn-48485.exe
1488	Unicorn-6362.exe
2320	Unicorn-26420.exe
3008	Unicorn-27772.exe
2828	Unicorn-14037.exe
648	Unicorn-35631.exe
1428	Unicorn-15381.exe
896	Unicorn-18911.exe
2440	Unicorn-9973.exe
2428	Unicorn-35439.exe
2404	Unicorn-12470.exe
1756	Unicorn-28236.exe
3040	Unicorn-61598.exe
1244	Unicorn-61863.exe
2340	Unicorn-29191.exe
1376	Unicorn-50358.exe
2812	Unicorn-1763.exe
2472	Unicorn-47966.exe
1216	Unicorn-56356.exe
2168	Unicorn-54318.exe
1040	Unicorn-26476.exe
596	Unicorn-46342.exe
2800	Unicorn-44998.exe
1572	Unicorn-38868.exe
2996	Unicorn-65288.exe

Loads dropped DLL 64 IoCs

pid	Process
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
3044	Unicorn-60630.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
3044	Unicorn-60630.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
2580	Unicorn-17299.exe
2580	Unicorn-17299.exe
3044	Unicorn-60630.exe
3044	Unicorn-60630.exe
1752	Unicorn-45098.exe
1752	Unicorn-45098.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
2904	Unicorn-59421.exe
2904	Unicorn-59421.exe
2580	Unicorn-17299.exe
2580	Unicorn-17299.exe
2888	Unicorn-47916.exe
2888	Unicorn-47916.exe
3044	Unicorn-60630.exe
2872	Unicorn-12834.exe
2652	Unicorn-51445.exe
1752	Unicorn-45098.exe
2652	Unicorn-51445.exe
3044	Unicorn-60630.exe
2872	Unicorn-12834.exe
1752	Unicorn-45098.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
2660	Unicorn-37639.exe
2660	Unicorn-37639.exe
2904	Unicorn-59421.exe
2904	Unicorn-59421.exe
2580	Unicorn-17299.exe
2580	Unicorn-17299.exe
944	Unicorn-21172.exe
944	Unicorn-21172.exe
1972	Unicorn-53164.exe
1972	Unicorn-53164.exe
592	Unicorn-59294.exe
592	Unicorn-59294.exe
3044	Unicorn-60630.exe
2652	Unicorn-51445.exe
2948	Unicorn-26357.exe
3044	Unicorn-60630.exe
2652	Unicorn-51445.exe
2948	Unicorn-26357.exe
2036	Unicorn-51126.exe
2036	Unicorn-51126.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
1752	Unicorn-45098.exe
2872	Unicorn-12834.exe
1056	Unicorn-39428.exe
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
1752	Unicorn-45098.exe
1056	Unicorn-39428.exe
2872	Unicorn-12834.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2016	2888	WerFault.exe	34
1508	1708	WerFault.exe	40
1940	2476	WerFault.exe	61
2212	1488	WerFault.exe	73
1740	1536	WerFault.exe	68
1308	3040	WerFault.exe	85
2484	2600	WerFault.exe	98
1608	1760	WerFault.exe	101
2284	2644	WerFault.exe	106
3160	1684	WerFault.exe	112
3464	2340	WerFault.exe	87
3740	2344	WerFault.exe	120
3508	1012	WerFault.exe	103
3564	896	WerFault.exe	80
3608	2076	WerFault.exe	132
4060	596	WerFault.exe	94
3448	2660	WerFault.exe	38
3604	1868	WerFault.exe	69
3116	1244	WerFault.exe	86
3212	1376	WerFault.exe	88
3244	2996	WerFault.exe	97
3200	2588	WerFault.exe	70
3292	2320	WerFault.exe	75
3296	2948	WerFault.exe	45
3928	1040	WerFault.exe	93
4104	2028	WerFault.exe	131
4896	2736	WerFault.exe	63
4920	1604	WerFault.exe	46
4936	912	WerFault.exe	139
4944	1860	WerFault.exe	122
5028	2152	WerFault.exe	146
5044	2764	WerFault.exe	163
5060	2808	WerFault.exe	150
5052	1168	WerFault.exe	169
4148	1968	WerFault.exe	125
4248	2520	WerFault.exe	126
4880	1796	WerFault.exe	130
4852	2812	WerFault.exe	89
4776	348	WerFault.exe	136
4152	1956	WerFault.exe	138
4156	2840	WerFault.exe	134
5000	2680	WerFault.exe	143
5136	2844	WerFault.exe	141
5168	2616	WerFault.exe	128
5152	708	WerFault.exe	152
5128	3132	WerFault.exe	195
5212	1572	WerFault.exe	95
5200	2404	WerFault.exe	83
5192	1600	WerFault.exe	153
5184	352	WerFault.exe	51
5176	2968	WerFault.exe	105
5224	1804	WerFault.exe	109
5232	2440	WerFault.exe	81
5240	3064	WerFault.exe	129
5248	1576	WerFault.exe	137
5272	2524	WerFault.exe	133
5264	2828	WerFault.exe	77
5256	1108	WerFault.exe	135
5304	592	WerFault.exe	43
5288	2056	WerFault.exe	57
5368	2472	WerFault.exe	90
5360	840	WerFault.exe	116
5628	1848	WerFault.exe	151
4784	2580	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-80.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58976.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
3044	Unicorn-60630.exe
2580	Unicorn-17299.exe
1752	Unicorn-45098.exe
2904	Unicorn-59421.exe
2888	Unicorn-47916.exe
2652	Unicorn-51445.exe
2872	Unicorn-12834.exe
2660	Unicorn-37639.exe
944	Unicorn-21172.exe
592	Unicorn-59294.exe
1972	Unicorn-53164.exe
2948	Unicorn-26357.exe
1056	Unicorn-39428.exe
1708	Unicorn-42766.exe
2036	Unicorn-51126.exe
2444	Unicorn-7270.exe
1604	Unicorn-51640.exe
1720	Unicorn-53560.exe
1280	Unicorn-47430.exe
856	Unicorn-52107.exe
352	Unicorn-11266.exe
1728	Unicorn-1297.exe
2360	Unicorn-62195.exe
2796	Unicorn-20897.exe
1744	Unicorn-21163.exe
2476	Unicorn-62579.exe
2056	Unicorn-53649.exe
2172	Unicorn-56449.exe
3020	Unicorn-42713.exe
2724	Unicorn-22829.exe
2736	Unicorn-22829.exe
2784	Unicorn-9787.exe
704	Unicorn-40051.exe
1868	Unicorn-28427.exe
2884	Unicorn-29388.exe
2668	Unicorn-29653.exe
1624	Unicorn-28619.exe
1536	Unicorn-46181.exe
1712	Unicorn-48485.exe
2588	Unicorn-48293.exe
1488	Unicorn-6362.exe
2320	Unicorn-26420.exe
648	Unicorn-35631.exe
3008	Unicorn-27772.exe
2828	Unicorn-14037.exe
1428	Unicorn-15381.exe
896	Unicorn-18911.exe
2404	Unicorn-12470.exe
1756	Unicorn-28236.exe
1244	Unicorn-61863.exe
2440	Unicorn-9973.exe
3040	Unicorn-61598.exe
2428	Unicorn-35439.exe
2340	Unicorn-29191.exe
1376	Unicorn-50358.exe
2812	Unicorn-1763.exe
2472	Unicorn-47966.exe
596	Unicorn-46342.exe
1216	Unicorn-56356.exe
2168	Unicorn-54318.exe
1040	Unicorn-26476.exe
2996	Unicorn-65288.exe
2600	Unicorn-28854.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3044	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	30
PID 2696 wrote to memory of 3044	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	30
PID 2696 wrote to memory of 3044	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	30
PID 2696 wrote to memory of 3044	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	30
PID 3044 wrote to memory of 2580	3044	Unicorn-60630.exe	31
PID 3044 wrote to memory of 2580	3044	Unicorn-60630.exe	31
PID 3044 wrote to memory of 2580	3044	Unicorn-60630.exe	31
PID 3044 wrote to memory of 2580	3044	Unicorn-60630.exe	31
PID 2696 wrote to memory of 1752	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	32
PID 2696 wrote to memory of 1752	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	32
PID 2696 wrote to memory of 1752	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	32
PID 2696 wrote to memory of 1752	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	32
PID 2580 wrote to memory of 2904	2580	Unicorn-17299.exe	33
PID 2580 wrote to memory of 2904	2580	Unicorn-17299.exe	33
PID 2580 wrote to memory of 2904	2580	Unicorn-17299.exe	33
PID 2580 wrote to memory of 2904	2580	Unicorn-17299.exe	33
PID 3044 wrote to memory of 2888	3044	Unicorn-60630.exe	34
PID 3044 wrote to memory of 2888	3044	Unicorn-60630.exe	34
PID 3044 wrote to memory of 2888	3044	Unicorn-60630.exe	34
PID 3044 wrote to memory of 2888	3044	Unicorn-60630.exe	34
PID 1752 wrote to memory of 2652	1752	Unicorn-45098.exe	35
PID 1752 wrote to memory of 2652	1752	Unicorn-45098.exe	35
PID 1752 wrote to memory of 2652	1752	Unicorn-45098.exe	35
PID 1752 wrote to memory of 2652	1752	Unicorn-45098.exe	35
PID 2696 wrote to memory of 2872	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	36
PID 2696 wrote to memory of 2872	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	36
PID 2696 wrote to memory of 2872	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	36
PID 2696 wrote to memory of 2872	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	36
PID 2904 wrote to memory of 2660	2904	Unicorn-59421.exe	38
PID 2904 wrote to memory of 2660	2904	Unicorn-59421.exe	38
PID 2904 wrote to memory of 2660	2904	Unicorn-59421.exe	38
PID 2904 wrote to memory of 2660	2904	Unicorn-59421.exe	38
PID 2580 wrote to memory of 944	2580	Unicorn-17299.exe	39
PID 2580 wrote to memory of 944	2580	Unicorn-17299.exe	39
PID 2580 wrote to memory of 944	2580	Unicorn-17299.exe	39
PID 2580 wrote to memory of 944	2580	Unicorn-17299.exe	39
PID 2888 wrote to memory of 1708	2888	Unicorn-47916.exe	40
PID 2888 wrote to memory of 1708	2888	Unicorn-47916.exe	40
PID 2888 wrote to memory of 1708	2888	Unicorn-47916.exe	40
PID 2888 wrote to memory of 1708	2888	Unicorn-47916.exe	40
PID 2652 wrote to memory of 592	2652	Unicorn-51445.exe	43
PID 2652 wrote to memory of 592	2652	Unicorn-51445.exe	43
PID 2652 wrote to memory of 592	2652	Unicorn-51445.exe	43
PID 2652 wrote to memory of 592	2652	Unicorn-51445.exe	43
PID 3044 wrote to memory of 1972	3044	Unicorn-60630.exe	41
PID 3044 wrote to memory of 1972	3044	Unicorn-60630.exe	41
PID 3044 wrote to memory of 1972	3044	Unicorn-60630.exe	41
PID 3044 wrote to memory of 1972	3044	Unicorn-60630.exe	41
PID 2872 wrote to memory of 2036	2872	Unicorn-12834.exe	42
PID 2872 wrote to memory of 2036	2872	Unicorn-12834.exe	42
PID 2872 wrote to memory of 2036	2872	Unicorn-12834.exe	42
PID 2872 wrote to memory of 2036	2872	Unicorn-12834.exe	42
PID 1752 wrote to memory of 1056	1752	Unicorn-45098.exe	44
PID 1752 wrote to memory of 1056	1752	Unicorn-45098.exe	44
PID 1752 wrote to memory of 1056	1752	Unicorn-45098.exe	44
PID 1752 wrote to memory of 1056	1752	Unicorn-45098.exe	44
PID 2696 wrote to memory of 2948	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	45
PID 2696 wrote to memory of 2948	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	45
PID 2696 wrote to memory of 2948	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	45
PID 2696 wrote to memory of 2948	2696	03fa0ada38c1bbaa52bac2f7d07a6b90N.exe	45
PID 2660 wrote to memory of 1604	2660	Unicorn-37639.exe	46
PID 2660 wrote to memory of 1604	2660	Unicorn-37639.exe	46
PID 2660 wrote to memory of 1604	2660	Unicorn-37639.exe	46
PID 2660 wrote to memory of 1604	2660	Unicorn-37639.exe	46

C:\Users\Admin\AppData\Local\Temp\03fa0ada38c1bbaa52bac2f7d07a6b90N.exe
"C:\Users\Admin\AppData\Local\Temp\03fa0ada38c1bbaa52bac2f7d07a6b90N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 240
        8⤵
        Program crash
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 244
        8⤵
        Program crash
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        7⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 224
        8⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 248
        7⤵
        Program crash
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        8⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        9⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 228
        9⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 236
        8⤵
        Program crash
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe
        8⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 216
        8⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 244
        7⤵
        Program crash
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        6⤵
        Executes dropped EXE
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        7⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        8⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 228
        8⤵
        Program crash
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
        7⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 244
        7⤵
        Program crash
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13285.exe
        6⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        7⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 216
        7⤵
        
        PID:5540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 244
        6⤵
        Program crash
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        7⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
        8⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        9⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 216
        9⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 248
        8⤵
        Program crash
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        7⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        6⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43734.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        6⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe
        7⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18533.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 240
        7⤵
        Program crash
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        7⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        6⤵
        
        PID:5716
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 224
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        7⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 228
        7⤵
        Program crash
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        6⤵
        
        PID:4848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 236
        6⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        6⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14994.exe
        7⤵
        
        PID:8636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 228
        6⤵
        Program crash
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        6⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        5⤵
        
        PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
        8⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        9⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe
        9⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
        9⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        8⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 248
        8⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42423.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42748.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        8⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5659.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        7⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 216
        7⤵
        Program crash
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52036.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        7⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        6⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9787.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58428.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
        8⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 228
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        7⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 244
        7⤵
        Program crash
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 228
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45471.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
        6⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 224
        7⤵
        Program crash
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62007.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2987.exe
        6⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3823.exe
        6⤵
        
        PID:3996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 216
        6⤵
        Program crash
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        5⤵
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        5⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44998.exe
        6⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44393.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        8⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        8⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        7⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 248
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        6⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36998.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        7⤵
        
        PID:9008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 240
        6⤵
        Program crash
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        6⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 224
        7⤵
        Program crash
        
        PID:5052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 248
        6⤵
        Program crash
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        5⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        6⤵
        
        PID:3932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 228
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:5748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 228
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 224
        6⤵
        Program crash
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        5⤵
        
        PID:2764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 244
        6⤵
        Program crash
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        5⤵
        
        PID:3156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 236
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        6⤵
        
        PID:3864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 248
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64937.exe
        5⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        5⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        5⤵
        
        PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26460.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        5⤵
        
        PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 236
      4⤵
      Program crash
      PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 224
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 236
      4⤵
      Program crash
      PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5008.exe
        6⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11104.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        8⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 220
        8⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        7⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 224
        7⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        6⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35801.exe
        7⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 216
        7⤵
        
        PID:6892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 244
        6⤵
        Program crash
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        7⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 228
        7⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        6⤵
        
        PID:4088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 240
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        5⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        6⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31364.exe
        6⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
        5⤵
        
        PID:3396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 240
        5⤵
        
        PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:2644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 224
        6⤵
        Program crash
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:6232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 248
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        5⤵
        
        PID:3384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 236
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47695.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2924.exe
        6⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        6⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        5⤵
        
        PID:4008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 224
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        5⤵
        
        PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
      4⤵
      PID:5532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 240
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        5⤵
        
        PID:2152
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 220
        6⤵
        Program crash
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exe
        5⤵
        
        PID:5408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 236
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
        5⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        5⤵
        
        PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28829.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17819.exe
      4⤵
      PID:5652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 244
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
      4⤵
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        5⤵
        
        PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 228
        5⤵
        Program crash
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
      4⤵
      PID:4844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 236
      4⤵
      PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
    3⤵
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        5⤵
        
        PID:9040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 248
      4⤵
      Program crash
      PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59731.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
    3⤵
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
    3⤵
    PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
    3⤵
    PID:8860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
    3⤵
    PID:9052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
        8⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        9⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31265.exe
        9⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        9⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
        9⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
        9⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        8⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 236
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        8⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 240
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        7⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 244
        7⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        6⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
        8⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 228
        8⤵
        Program crash
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
        7⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 244
        7⤵
        Program crash
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        6⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
        8⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 248
        7⤵
        Program crash
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
        6⤵
        
        PID:3856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 244
        6⤵
        Program crash
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 220
        6⤵
        Program crash
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        6⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        7⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 228
        7⤵
        Program crash
        
        PID:4776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 236
        6⤵
        Program crash
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37276.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        6⤵
        
        PID:3172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 228
        6⤵
        Program crash
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 248
        5⤵
        Program crash
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35491.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53971.exe
        8⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        7⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 248
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        6⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        7⤵
        
        PID:9148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 244
        6⤵
        Program crash
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe
        6⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        7⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        6⤵
        
        PID:4860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 244
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60456.exe
        5⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        6⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        5⤵
        
        PID:4268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 224
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        5⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        7⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 248
        7⤵
        Program crash
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        6⤵
        
        PID:3576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 244
        6⤵
        Program crash
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        5⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
        6⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        5⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        5⤵
        
        PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
      4⤵
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        5⤵
        
        PID:2224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 240
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10982.exe
      4⤵
      PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46127.exe
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        5⤵
        
        PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57842.exe
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
      4⤵
      PID:8472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 240
        5⤵
        Program crash
        
        PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        5⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 248
        6⤵
        Program crash
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        5⤵
        
        PID:3320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 244
        5⤵
        Program crash
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
      4⤵
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        5⤵
        
        PID:3800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 248
        5⤵
        Program crash
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      4⤵
      PID:5144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 248
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63756.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        6⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        6⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        5⤵
        
        PID:3868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 244
        5⤵
        Program crash
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        5⤵
        
        PID:5776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 224
        5⤵
        
        PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
      4⤵
      PID:5280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 244
      4⤵
      PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 224
      4⤵
      Program crash
      PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 224
      4⤵
      Program crash
      PID:3740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
    3⤵
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
    3⤵
    PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
    3⤵
    PID:8000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61076.exe
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        8⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        7⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 228
        7⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64424.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        7⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 220
        7⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        6⤵
        
        PID:3948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 236
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        5⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        6⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        7⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        6⤵
        
        PID:5352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 216
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        6⤵
        
        PID:3624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 228
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62537.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        5⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5712.exe
        7⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 228
        7⤵
        Program crash
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        6⤵
        
        PID:3368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 244
        6⤵
        Program crash
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        5⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16314.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        5⤵
        
        PID:4964
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 248
        5⤵
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
      4⤵
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        5⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63631.exe
        5⤵
        
        PID:4252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 244
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
      4⤵
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        5⤵
        
        PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
      4⤵
      PID:8676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
        5⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44324.exe
        6⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60759.exe
        7⤵
        
        PID:8648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 236
        6⤵
        Program crash
        
        PID:4148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 236
        5⤵
        Program crash
        
        PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        6⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        5⤵
        
        PID:4988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 244
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
      4⤵
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        5⤵
        
        PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 244
      4⤵
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        5⤵
        
        PID:3768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 248
        5⤵
        Program crash
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 244
      4⤵
      Program crash
      PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
    3⤵
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29641.exe
      4⤵
      PID:3904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 248
      4⤵
      Program crash
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
    3⤵
    PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe
    3⤵
    PID:8068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
    3⤵
    PID:8320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        5⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        6⤵
        
        PID:3848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 216
        6⤵
        
        PID:5560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 248
        5⤵
        Program crash
        
        PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16191.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 224
        5⤵
        
        PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 236
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      4⤵
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 248
      4⤵
      Program crash
      PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
    3⤵
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
      4⤵
      PID:5072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 248
      4⤵
      PID:6976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 248
    3⤵
    - Program crash
    PID:3296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
      4⤵
      PID:2076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 240
        5⤵
        Program crash
        
        PID:3608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 216
      4⤵
      Program crash
      PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
    3⤵
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 228
      4⤵
      Program crash
      PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 248
    3⤵
    - Program crash
    PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
    3⤵
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 244
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 244
    3⤵
    - Program crash
    PID:5232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
  2⤵
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51999.exe
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 236
    3⤵
    - Program crash
    PID:4248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
  2⤵
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
  2⤵
  PID:5160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
  2⤵
  PID:7048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
  2⤵
  PID:8844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
  2⤵
  PID:8932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe

Filesize
468KB

MD5
dd5eda07c24d0a7718df93b3e71d4100

SHA1
97ce6362c0ecec839b9f7220ef6ceb3798147f3a

SHA256
6c5e265a60dc8e85e8cae78ab2c5c40916a6bee785ea11eb78a26f004d56e042

SHA512
06a4fc3b48a756fcda5626445075d9c83925a5fe2a3b0cc12f05dc51a95c289ec0c51c5f39d0bd2b0cdc8ad18044089134baf084a35de20c5bf5ae8031c8c04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

Filesize
468KB

MD5
43cbd29e6519c596e90e4ff64c9222e8

SHA1
d85b9bb492a99045a13fe354728b0a0641bdde54

SHA256
52882e685c15183fc75c2141c87f480fc31d6f772be5769e49d0cd890e67c500

SHA512
e47420167502e3cb07b1de3345385d9e6b3ae96bec4dc0f63bfd211e21b98ccbe38d52ed5c1d644f6aa4535547f002608e7a5f9e3d61f291a8d177efce4c2fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe

Filesize
468KB

MD5
c3f6373d1301c0a6d2f5355b5bd742fd

SHA1
8fa144a40b04a21103900e684e2afbef3b3b398c

SHA256
c999bb80a5c23b4a5636573beefdaed215aa46eeca7a4b7bf2c6c144634e38f8

SHA512
eb27ecd2764fd82c65fd3f0be9cf6513605f6db1958f8a1123b9fa647ce9350172e78b3cdabe9ae43da2f9aef7ae990463a664abf35fc3f94f376a33d2b02ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe

Filesize
468KB

MD5
18328094c12911360b3b8ecb2cd15c10

SHA1
555563ba5ff7a683ec194515de9e2f11f71e399b

SHA256
813192d26c6f1d4962ed4e0fb61d5ec9b96a31657c23213e9961030101ce184b

SHA512
52237c15cdd6398a06a3877e6c4ad562bf22555049598a2b1a64b2d0f3712baba53d4a63ba7ab4fbd497b35586931de68b8d02529e4bc84bf15451fa0546a2ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe

Filesize
468KB

MD5
70a6c5fb31dacdbfca5551c51223caed

SHA1
9c17b00eb31ecaecd0fc045f1e569992d6573ef8

SHA256
0197dc97c4ed7c0bb16bfa1662f911b47b8ad16767885c6c68db0a4ea95b4ea5

SHA512
eba91f7ca12f0451c890c8b733fb9a117e0bc75e650f483cf2da18bf2f3416678d205e29968a0e2284a73bb462c368b6ac5ec27faf5ca5480aafe9dd987b0ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe

Filesize
468KB

MD5
bb9a61899fa186ca180973f599d13df6

SHA1
b79f5c1c3e6b91e48d584ffcc789301a70302d01

SHA256
534e0fa996add9c80cd84b3b5426bdc834bdab110debfd9862d3a26d2ebe9fa5

SHA512
fad79e70644735338626c076bd34d7bca2e44c433340d75cea5a63e323edfcf9185e19f7edb2dfc5693ed37650800801969fa0b732536f8c3328cdd1ba58d516

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe

Filesize
468KB

MD5
a58aa60a14e9e223751bbd5b0cce562d

SHA1
240b7dcc7e422a9c92dc0be727b371a80c7394b5

SHA256
06ef245da62df134d273ca5006c7b9f2e2ad41851c0c41b43364e2734761b29c

SHA512
b162c34eba7651335d1930ae4ddf4c5d1b2cf81031a7498e7c396cc20075c804b4f7d67313069dc25e36179cdd2821b834b64a65d47c656619d501f9bdcc5cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe

Filesize
468KB

MD5
b7844478082766eb78e636c6ceb91205

SHA1
4df4b208e02a73a456f5100cdb1f0bfed8a0169f

SHA256
dd82548efde28f472afae5ec7ec19c2e43875984100bd5d092dc7489273e472d

SHA512
b0b26b874aacc3dcfaeab7389c7cf0705684a5779f6949377bd6c1648475ca853c02625f8709fef77076530e32ef2d7bbdfb05c2b959b41d33efa246572ab8b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5659.exe

Filesize
468KB

MD5
dc81724e93ffb6718579ad700d7446f3

SHA1
d1975a52a55c1d72a86ba3f4769a97608e6e3d9c

SHA256
225744a8a917f984320a43c2c55034c2aa052c4617d3ad887544fce943a2aa4e

SHA512
bd3a9ba2e278aeb00f880f1384b52600ffc7ecb9ccf228d6b4639bc27d14c44195897bcf3cfc77f0a089ceca67d0462ffbe2e0ad087f7d6336fea81a745a9f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe

Filesize
468KB

MD5
417dec585d43a5f887eb880dbcc3f80c

SHA1
2116d3ee575a9658ced3b39e575ff8d430662f09

SHA256
904d54bfa3433f44ed40e32e648a1686125f69c4510dac7aee290c1039950b35

SHA512
7407a2f114dc422a991a8d3e964e2c35f7f4a6c93edaed025b3716ca43218989a6f506b4ca52aa9bb596be8082e820276efd7e0135b5c991630e15ed663ea0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe

Filesize
468KB

MD5
0b59a73b94d946812c1ef1203d1f0a61

SHA1
4b53438958e3b49d110d446ff02082218ca847ee

SHA256
a90e4b8d99527eb572de5beeee2234746d1785fafe8fbe12da64ccf2962dcbb3

SHA512
a8ff72e954ba152a0143420ffe1a5e3fb69f871db286c88dcff03cf04d346b3df0044bd5b9c71a35bc67d4108fe965d3cd7aa513e475fc53a607f4bf75001095

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe

Filesize
468KB

MD5
0922d5f6a1789de869b30d3c54f52185

SHA1
9d3f617688a1be1105ec24ba4d4d6ada91e50f02

SHA256
0766897630d28c24f2fdaf19f1fe66db9f7c8d42c60bae14b87f5529c646e998

SHA512
ba853f77d764ace043a492b4101df107ede16f7cd4d0e54f2619f13791a09cfe35f13bf11f30b4073746e0111abde21fb188cd804196f1cf2abf323af9199f9d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe

Filesize
468KB

MD5
09cab23c874dbccbc69778d3cfd8d929

SHA1
d143395c46801711f6477052963a73cbb7d4dafe

SHA256
f4252d56ec2fc84a80a41ed7feb6f08479be7e44c496dd67ddd573e89befa47d

SHA512
5786b6052c3471623533118e332f7087beff42a2b7556e2b5a35a2773355d761006e6558308826da7aac46de4a9b153ec01cfc35f414d96c4e5c36ba1cafa2a3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe

Filesize
468KB

MD5
11cd830a48ea08fa9876b95007fd5b35

SHA1
d2df11b9137c4832f2bf57536bb912c83798cbf5

SHA256
6c4a4387d9e02b9326c128a9fb0ae24a2f164ca6d834b374709928a937c9a387

SHA512
d393790a58d575f42d42f1565c6ca9f8d0516c12d688340b84e3ac5a64fa4fa3cd7bc3120e861f186471c785ce1d88e7a02e0f84a701d2be6415d3bf43f6ab2b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe

Filesize
468KB

MD5
3b81f0fc3c22fb218f6bfe8e7c1b84a6

SHA1
bbcb7fb8acf59f0999de3f51156a222ece015fea

SHA256
724950a1bb84c2ad9ddc67ba3fad027192cea0ee6371b52468559c3b7202fcd3

SHA512
56a779392c595d409a36457644289dddc649ff1ff2ce775dd3ada7a8ede0c206910fa368246e97c82ce363e5b4978da8a7b9158782000772c8dde8c981c15254

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42766.exe

Filesize
468KB

MD5
660a1215dfb4ba5a404d1f92c58696be

SHA1
7cca9c51113c485ff7dde2de1052f74817da022a

SHA256
71c71dc44f6703e167bfd83a40d75950e47b682073138393beaf747ec0348ebd

SHA512
f2ef40e99622d5a7dbf921943f8d7a2587c20beeccf4eaa994ac0d4e3af361d683630686e5febf0f4457f23fe51848c89b0fc16b27ad4e16e49ed3c5358977b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe

Filesize
468KB

MD5
da453c1a5f0367ad299c2fb76a703211

SHA1
fb50d6fa1c9d00843defaa737c542a2aafeca2ad

SHA256
7027b9653abd06bf4b2a6b026480ccbf4f4d3e49d796545e8f870d0a515699dc

SHA512
5cf1830ab2aa0e11721e5dc9e7d0be60e652db0a84bbe8d2209695d956640be686367d1c8bf482fa478dc9a8f267e19f1336f7583951c6ce90b55d70b739c685

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe

Filesize
468KB

MD5
98303e8befee6315a998eea4247a7a36

SHA1
af740f751dda441bc05f7aa7de269f9e0ed9dbe6

SHA256
603709f8e1b4ebb63cd799d45546721a35621a3e135f387eddf46ed458974359

SHA512
2da686cc617444fbb35d481e67aaa40679c44fa02c67055910c4625e370c2c7095fd37b400d6be252b9e7b01972c264916b3c92e354737bd170288d86c9613b7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51445.exe

Filesize
468KB

MD5
fe2eed101d55a68bc089f43581cbe6f9

SHA1
5d7f1d078efc87998c80694bddb591aa0828fd07

SHA256
1c6b50586bb73ba809deb641e6997a2710eb30caa37e23ff492e869ba33172fc

SHA512
b9934b0996fbcc1c8e455abba9bbf978d308999d382aa1c0e7ef2fe2519ab93bea9376d75ec4bc1124c10fa155e5079923a3185322851b4c51dc75d6f2b46dd1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe

Filesize
468KB

MD5
b3f419d41b23452599ced567a555d8ee

SHA1
dbe861177ff246e51b9c6b9e7b3345be29da228d

SHA256
afe6f988c34ebcc1c105cbb12da5345833b7fe6800a8e403059c0d9bbd46acca

SHA512
cd755ea0a555ae4e553e41a28e36114107c404ce737459b545888f9d45ecd9cd0642dd9fd846964dede855ace6e1b382678011f17f6bb54977d6f33e3e3a9ffa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe

Filesize
468KB

MD5
762fe910bcacce1a9b5a666e6ed1d6c8

SHA1
e36715658e5edf7e8a62f6833c0d1380c947f213

SHA256
049eb0ed016db24d692c75e2c53a3e777f2c35197e498f376e4a1d13232452df

SHA512
3d657c37ff250c48ceef8fbde2f0726651f0db5a1cc2b5b01d334e0c0fe17f04f0981e5009752cc965744f056afd9d9864dfce1a4d87936e60f98a0a9db855f0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe

Filesize
468KB

MD5
629ed2bf253f18c05967db3dfc39d378

SHA1
9c3e9487175b6af8b46b245d35fd81c82b8047e7

SHA256
9a0f069eeb951eaa24220f9c4991fffa0a706a46d551203052603286534e2f30

SHA512
ae0cb08e5e08ef8fce97872ea9a2747c73b047bc9d3df7abffd4acd6241adcb638459e49123568daacf77c9409ac6e01957bd12279390c26f57e54b932b9352d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe

Filesize
468KB

MD5
88122a71a5ddcb175f4af5a20c630001

SHA1
c01d7dc3a02f0b741249ca0cd000ba0aae8e153f

SHA256
61ce94615e800a8676d49a0d4b321ab5f4d2fcaead9fcb7fd3e8b47bd6da35da

SHA512
8947c7d77f79825770dd5a04a50a7e0b6a4c8535057f9109661611b5a077a1ef569bde13282f347104f45157a5596cb04afdc8da9e5e9513122b22841013f0f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe

Filesize
468KB

MD5
a1e6094cbced462a9760d2fd2a2df40d

SHA1
54277f56ef071a3f110bfe422cd4ad6f0e340018

SHA256
105cc9d32c55972718aefb61bdc66fa41ec0c4236f95a7c6374f684381dbccc3

SHA512
c87c91ce11759abd44348ee6d1f7018fe95d28ecbf7d19263b2397c933d56e295dd14ebc8e7273832504ba4770c27aa51fb43bdce590d35883bc2b6becee191e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe

Filesize
468KB

MD5
631dd3040714fd06bdaa1a77810d549f

SHA1
3b0cc04d373a4c3855b90b39fca7e8fed64f91f1

SHA256
dcd0145b150fd345243de5940bf2bbfb38b88a7e9ad5874616e2eb862ecd1c81

SHA512
25cfd4b707698fcf24f209943c346f8212b8d108536cd6a3636363a5ed1d954efc72c760e9a4244dde7f1d32f87a19375c4a5d60b34d25a1b0fb6a25b5c4a599

Download Submit
memory/352-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-256-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/592-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-255-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/704-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-402-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/856-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-366-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/944-232-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/944-230-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/944-367-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/1056-303-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1056-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1056-317-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1280-339-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1280-340-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1280-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-383-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/1604-387-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/1720-342-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1720-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-338-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1728-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-316-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/1752-301-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/1868-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-409-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1972-246-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1972-245-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2036-288-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2036-289-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2036-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-370-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2444-369-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2444-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-44-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2580-228-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2580-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-364-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2580-363-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2580-229-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2588-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-156-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2652-157-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2652-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-276-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2652-278-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2660-400-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2660-193-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2660-206-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2660-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-393-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2668-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-83-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2696-6-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2696-313-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2696-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-173-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2696-11-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2696-172-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2696-300-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2736-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-302-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2872-160-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2872-315-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2872-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-155-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2884-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-120-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2888-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-380-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/2904-379-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/2904-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-97-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/2904-208-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/2904-207-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/2948-279-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2948-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-277-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/3020-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-154-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/3044-19-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/3044-275-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/3044-159-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/3044-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download