aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6c

Analysis

max time kernel
119s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
Size

468KB
MD5

5946b0fa700c723a081e05a3966d7d40
SHA1

1990f6590cb75d1a20137e62055ab1e9909a6ce8
SHA256

aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6c
SHA512

999049f01bf36c66f33aa6b5b88a5af86d3431c70ba357ce8ff4d1ce61d210deb88f5b92698b7e654ddb506bc70e14e1e154972c2bae7a8d483e5e3a6ab4176c
SSDEEP

3072:7+mnogKhj28UWby91w3/qf8/oVhjyQplPmHBNTHf82Y+RTf/E+ls:7+WoBXUWk1+/qfassl82fRf/E

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2552	Unicorn-52288.exe
2788	Unicorn-34831.exe
2948	Unicorn-39303.exe
2248	Unicorn-28063.exe
2132	Unicorn-47929.exe
2808	Unicorn-1655.exe
892	Unicorn-12812.exe
1188	Unicorn-6682.exe
2908	Unicorn-9091.exe
2192	Unicorn-28692.exe
2172	Unicorn-18912.exe
3064	Unicorn-55498.exe
1532	Unicorn-19571.exe
1004	Unicorn-64325.exe
772	Unicorn-64325.exe
2480	Unicorn-52628.exe
2428	Unicorn-62981.exe
2484	Unicorn-31196.exe
1464	Unicorn-46267.exe
948	Unicorn-23986.exe
1992	Unicorn-38669.exe
1524	Unicorn-21259.exe
2600	Unicorn-31848.exe
2168	Unicorn-46147.exe
1952	Unicorn-8108.exe
2068	Unicorn-27974.exe
2724	Unicorn-35378.exe
2092	Unicorn-19116.exe
2108	Unicorn-48643.exe
2864	Unicorn-42852.exe
2744	Unicorn-23837.exe
2932	Unicorn-19583.exe
2684	Unicorn-4507.exe
2752	Unicorn-39981.exe
2016	Unicorn-59847.exe
2696	Unicorn-59582.exe
2564	Unicorn-19479.exe
1904	Unicorn-12566.exe
3020	Unicorn-22279.exe
2736	Unicorn-28410.exe
1580	Unicorn-60806.exe
2568	Unicorn-28410.exe
2224	Unicorn-15368.exe
2892	Unicorn-2872.exe
2212	Unicorn-3137.exe
2676	Unicorn-29587.exe
624	Unicorn-18317.exe
2540	Unicorn-53791.exe
2468	Unicorn-46775.exe
1960	Unicorn-7429.exe
1156	Unicorn-63838.exe
2088	Unicorn-16867.exe
756	Unicorn-29556.exe
880	Unicorn-16750.exe
1700	Unicorn-13796.exe
2296	Unicorn-48654.exe
2792	Unicorn-25502.exe
2960	Unicorn-15296.exe
2244	Unicorn-44632.exe
2260	Unicorn-25385.exe
2620	Unicorn-3302.exe
2884	Unicorn-58441.exe
2880	Unicorn-52503.exe
820	Unicorn-48052.exe

Loads dropped DLL 64 IoCs

pid	Process
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
2552	Unicorn-52288.exe
2552	Unicorn-52288.exe
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
2552	Unicorn-52288.exe
2788	Unicorn-34831.exe
2788	Unicorn-34831.exe
2552	Unicorn-52288.exe
2248	Unicorn-28063.exe
2248	Unicorn-28063.exe
2788	Unicorn-34831.exe
2132	Unicorn-47929.exe
2132	Unicorn-47929.exe
2788	Unicorn-34831.exe
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
2552	Unicorn-52288.exe
2552	Unicorn-52288.exe
2948	Unicorn-39303.exe
2948	Unicorn-39303.exe
2808	Unicorn-1655.exe
2808	Unicorn-1655.exe
2248	Unicorn-28063.exe
2248	Unicorn-28063.exe
1188	Unicorn-6682.exe
892	Unicorn-12812.exe
1188	Unicorn-6682.exe
892	Unicorn-12812.exe
2132	Unicorn-47929.exe
2552	Unicorn-52288.exe
2908	Unicorn-9091.exe
2132	Unicorn-47929.exe
2908	Unicorn-9091.exe
2788	Unicorn-34831.exe
2552	Unicorn-52288.exe
2788	Unicorn-34831.exe
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
2192	Unicorn-28692.exe
2192	Unicorn-28692.exe
2172	Unicorn-18912.exe
2172	Unicorn-18912.exe
3064	Unicorn-55498.exe
3064	Unicorn-55498.exe
2948	Unicorn-39303.exe
2948	Unicorn-39303.exe
2808	Unicorn-1655.exe
2808	Unicorn-1655.exe
1532	Unicorn-19571.exe
1532	Unicorn-19571.exe
2248	Unicorn-28063.exe
2248	Unicorn-28063.exe
2908	Unicorn-9091.exe
2428	Unicorn-62981.exe
2908	Unicorn-9091.exe
2428	Unicorn-62981.exe
1524	Unicorn-21259.exe
1524	Unicorn-21259.exe
2172	Unicorn-18912.exe
2172	Unicorn-18912.exe
1004	Unicorn-64325.exe
1004	Unicorn-64325.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	2072	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21703.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
2552	Unicorn-52288.exe
2788	Unicorn-34831.exe
2248	Unicorn-28063.exe
2132	Unicorn-47929.exe
2948	Unicorn-39303.exe
2808	Unicorn-1655.exe
892	Unicorn-12812.exe
2192	Unicorn-28692.exe
2908	Unicorn-9091.exe
1188	Unicorn-6682.exe
2172	Unicorn-18912.exe
3064	Unicorn-55498.exe
1532	Unicorn-19571.exe
1004	Unicorn-64325.exe
2480	Unicorn-52628.exe
1464	Unicorn-46267.exe
2428	Unicorn-62981.exe
948	Unicorn-23986.exe
772	Unicorn-64325.exe
2484	Unicorn-31196.exe
1992	Unicorn-38669.exe
1524	Unicorn-21259.exe
2600	Unicorn-31848.exe
2068	Unicorn-27974.exe
2168	Unicorn-46147.exe
1952	Unicorn-8108.exe
2724	Unicorn-35378.exe
2108	Unicorn-48643.exe
2568	Unicorn-28410.exe
2092	Unicorn-19116.exe
2864	Unicorn-42852.exe
2752	Unicorn-39981.exe
2932	Unicorn-19583.exe
2744	Unicorn-23837.exe
2684	Unicorn-4507.exe
2016	Unicorn-59847.exe
2696	Unicorn-59582.exe
2564	Unicorn-19479.exe
2736	Unicorn-28410.exe
1904	Unicorn-12566.exe
2892	Unicorn-2872.exe
3020	Unicorn-22279.exe
1580	Unicorn-60806.exe
2224	Unicorn-15368.exe
2212	Unicorn-3137.exe
2676	Unicorn-29587.exe
624	Unicorn-18317.exe
2540	Unicorn-53791.exe
2468	Unicorn-46775.exe
1960	Unicorn-7429.exe
1156	Unicorn-63838.exe
2088	Unicorn-16867.exe
756	Unicorn-29556.exe
2296	Unicorn-48654.exe
2792	Unicorn-25502.exe
2884	Unicorn-58441.exe
880	Unicorn-16750.exe
2880	Unicorn-52503.exe
2260	Unicorn-25385.exe
2960	Unicorn-15296.exe
1700	Unicorn-13796.exe
2244	Unicorn-44632.exe
820	Unicorn-48052.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2552	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	29
PID 396 wrote to memory of 2552	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	29
PID 396 wrote to memory of 2552	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	29
PID 396 wrote to memory of 2552	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	29
PID 2552 wrote to memory of 2788	2552	Unicorn-52288.exe	30
PID 2552 wrote to memory of 2788	2552	Unicorn-52288.exe	30
PID 2552 wrote to memory of 2788	2552	Unicorn-52288.exe	30
PID 2552 wrote to memory of 2788	2552	Unicorn-52288.exe	30
PID 396 wrote to memory of 2948	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	31
PID 396 wrote to memory of 2948	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	31
PID 396 wrote to memory of 2948	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	31
PID 396 wrote to memory of 2948	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	31
PID 2788 wrote to memory of 2132	2788	Unicorn-34831.exe	32
PID 2788 wrote to memory of 2132	2788	Unicorn-34831.exe	32
PID 2788 wrote to memory of 2132	2788	Unicorn-34831.exe	32
PID 2788 wrote to memory of 2132	2788	Unicorn-34831.exe	32
PID 2552 wrote to memory of 2248	2552	Unicorn-52288.exe	33
PID 2552 wrote to memory of 2248	2552	Unicorn-52288.exe	33
PID 2552 wrote to memory of 2248	2552	Unicorn-52288.exe	33
PID 2552 wrote to memory of 2248	2552	Unicorn-52288.exe	33
PID 2248 wrote to memory of 2808	2248	Unicorn-28063.exe	34
PID 2248 wrote to memory of 2808	2248	Unicorn-28063.exe	34
PID 2248 wrote to memory of 2808	2248	Unicorn-28063.exe	34
PID 2248 wrote to memory of 2808	2248	Unicorn-28063.exe	34
PID 2132 wrote to memory of 892	2132	Unicorn-47929.exe	36
PID 2132 wrote to memory of 892	2132	Unicorn-47929.exe	36
PID 2132 wrote to memory of 892	2132	Unicorn-47929.exe	36
PID 2132 wrote to memory of 892	2132	Unicorn-47929.exe	36
PID 2788 wrote to memory of 2908	2788	Unicorn-34831.exe	35
PID 2788 wrote to memory of 2908	2788	Unicorn-34831.exe	35
PID 2788 wrote to memory of 2908	2788	Unicorn-34831.exe	35
PID 2788 wrote to memory of 2908	2788	Unicorn-34831.exe	35
PID 396 wrote to memory of 2192	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	37
PID 396 wrote to memory of 2192	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	37
PID 396 wrote to memory of 2192	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	37
PID 396 wrote to memory of 2192	396	aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe	37
PID 2552 wrote to memory of 1188	2552	Unicorn-52288.exe	38
PID 2552 wrote to memory of 1188	2552	Unicorn-52288.exe	38
PID 2552 wrote to memory of 1188	2552	Unicorn-52288.exe	38
PID 2552 wrote to memory of 1188	2552	Unicorn-52288.exe	38
PID 2948 wrote to memory of 2172	2948	Unicorn-39303.exe	39
PID 2948 wrote to memory of 2172	2948	Unicorn-39303.exe	39
PID 2948 wrote to memory of 2172	2948	Unicorn-39303.exe	39
PID 2948 wrote to memory of 2172	2948	Unicorn-39303.exe	39
PID 2808 wrote to memory of 3064	2808	Unicorn-1655.exe	40
PID 2808 wrote to memory of 3064	2808	Unicorn-1655.exe	40
PID 2808 wrote to memory of 3064	2808	Unicorn-1655.exe	40
PID 2808 wrote to memory of 3064	2808	Unicorn-1655.exe	40
PID 2248 wrote to memory of 1532	2248	Unicorn-28063.exe	41
PID 2248 wrote to memory of 1532	2248	Unicorn-28063.exe	41
PID 2248 wrote to memory of 1532	2248	Unicorn-28063.exe	41
PID 2248 wrote to memory of 1532	2248	Unicorn-28063.exe	41
PID 1188 wrote to memory of 1004	1188	Unicorn-6682.exe	42
PID 1188 wrote to memory of 1004	1188	Unicorn-6682.exe	42
PID 1188 wrote to memory of 1004	1188	Unicorn-6682.exe	42
PID 1188 wrote to memory of 1004	1188	Unicorn-6682.exe	42
PID 892 wrote to memory of 772	892	Unicorn-12812.exe	43
PID 892 wrote to memory of 772	892	Unicorn-12812.exe	43
PID 892 wrote to memory of 772	892	Unicorn-12812.exe	43
PID 892 wrote to memory of 772	892	Unicorn-12812.exe	43
PID 2132 wrote to memory of 2480	2132	Unicorn-47929.exe	44
PID 2132 wrote to memory of 2480	2132	Unicorn-47929.exe	44
PID 2132 wrote to memory of 2480	2132	Unicorn-47929.exe	44
PID 2132 wrote to memory of 2480	2132	Unicorn-47929.exe	44

C:\Users\Admin\AppData\Local\Temp\aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe
"C:\Users\Admin\AppData\Local\Temp\aafa3ec31b4a6499bfe95efc8f97ef20fd1ef03359c9cfcf8519882b16c4de6cN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3137.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        8⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exe
        9⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        9⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32113.exe
        9⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        8⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        8⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        7⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43277.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10046.exe
        8⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        7⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        8⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        7⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59113.exe
        7⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        7⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        6⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
        6⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        5⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        6⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        7⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        6⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        7⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36757.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        6⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59841.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        5⤵
        
        PID:472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15911.exe
        6⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
        5⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        6⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
      4⤵
      PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55883.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
      4⤵
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61882.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
        7⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40334.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        6⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32113.exe
        7⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        6⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        5⤵
        Executes dropped EXE
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        5⤵
        
        PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        7⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
        7⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        6⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        7⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        6⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62757.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        6⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
        6⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        5⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24470.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51782.exe
        5⤵
        
        PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        5⤵
        
        PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-91.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-91.exe
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13167.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      4⤵
      PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        7⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        6⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18560.exe
        5⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18080.exe
        6⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        5⤵
        
        PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        6⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        5⤵
        
        PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        5⤵
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
      4⤵
      PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41420.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
      4⤵
      PID:2072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 200
        5⤵
        Program crash
        
        PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19479.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
      4⤵
      PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
      4⤵
      PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exe
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36480.exe
    3⤵
    PID:4120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63838.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        7⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        6⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5531.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        6⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        6⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31635.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        6⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        5⤵
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        6⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57568.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        7⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        6⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
        6⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        5⤵
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        5⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        5⤵
        
        PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
      4⤵
      PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
      4⤵
      PID:4360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        6⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        5⤵
        
        PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
      4⤵
      PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
      4⤵
      PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
      4⤵
      PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
      4⤵
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
      4⤵
      PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
    3⤵
    PID:4588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38669.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39804.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        5⤵
        
        PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      4⤵
      PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12637.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
      4⤵
      PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
      4⤵
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
      4⤵
      PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
    3⤵
    PID:4336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
      4⤵
      PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
      4⤵
      PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
    3⤵
    PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
    3⤵
    PID:4996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
    3⤵
    PID:4468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe
  2⤵
  PID:3336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
  2⤵
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
  2⤵
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe

Filesize
468KB

MD5
d401fb2f57d16d34c642d001330ed888

SHA1
71c281d93c353000fef9c1ed542a9ca7f27c9178

SHA256
036810a73a46649392a3f8accc1f9970a75f44a3c84ff01662262a698c5eea20

SHA512
80e64524b6b56d64da0e655732674137586936aea6f16c469341cb381db4ef13a2377a87e8d111a1ad95470d986a3ead0584a59cb2aa1fa814b548cb2546b747

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe

Filesize
468KB

MD5
fca1238026c1c7ae556df7be794c354a

SHA1
d6a87d29e11aa33fa4461fcb2f847bd1fd9e639b

SHA256
cad5a7f7cde0bc28b7f150a45147be10728910b0913b9265710b58371ab18aa3

SHA512
7cebf00a30c7160d6a69ea6fd0a3473b4730a43b75595b4769e1982f8bb5b9698bdda7f9bc5bd4a7d86dabcb7b56471ecd7163d95e4ee536840bf8b0e65c9675

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe

Filesize
468KB

MD5
fe0df2c7f1477f926ef885d3a1df0e3c

SHA1
32106bb0438dff304a708fa8b8b77bce41875dc8

SHA256
2b5444e9bfa63a518df295fdf25b5428b758dc12f8ed90645acb0c36b8e25bc0

SHA512
d1254f5c78a69c32c789b4548a67338e885e46ffe9e9c9b7a84b79ff388d8e52ac6bc7d7b59e0168f19210ae797fc68bfd5e5222b5e398d69e883b2c93dcd297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe

Filesize
468KB

MD5
616b3e14f89d3a2c06aa7d22c9f88605

SHA1
48b3f2465083eb56bc73765d5bc820689555856b

SHA256
2aa72699502e035fe77202acbafd2164dc79b50a824fb198a4b55600cf1f75ec

SHA512
50c713d23bcf14c51dafd323c5d1dca583c924dc155249a4d0066c09648736f143a6858e4282886e2fe014b0183d78b397af4d73e3fdd8fbc57e8c1da6d26eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe

Filesize
468KB

MD5
8b7d226b5663b271f7422199ce7ded0b

SHA1
2d8918bcdef6c50791d90b901d69d5cd485cc1e5

SHA256
77d40d510c941f81cc22f7753f91c6f7bad0adf1ba07d4554c45297c2508e710

SHA512
0529ad74acc96889765e0b52438e7715c8716ac5486650557703f7c8d4551292ec75fd49ba4faa543ae7f21fa2b1d9441d239446ffb7a32ea7756d9b8fd3a07f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe

Filesize
468KB

MD5
676d7c6ed2715d1cfacd3eb0901610b8

SHA1
4e154c190f32d0897e2fbd63e7c4e39dbfeda963

SHA256
da644f0ba504fcf0794e7ed57e50180ab92f6f79340ff0954e1aad80e69ae32e

SHA512
c59fba2097d4cdfa55777c26961663e035ca51209cf620db59d024dbac2feea86132ecaefb70f0ddaf413e9ccce11265123ba4c1227aa44faa7cda10e29a094e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe

Filesize
468KB

MD5
630ad45fd2aead32116fbb02f59acc96

SHA1
5bfa0f65f6dbea609ce74d7eed583ae3d1819827

SHA256
c4e8a309f71156008b9d4e39a44b17a0aa221df5e8160feca4c4c083d6e95e41

SHA512
6908bb73f81942f3a29264f460fa11c2bd0516abbf1b461c54d2127d2f0421794dc3a2f601ad2d6936a6b2409d70c80bfdd1517c6928353bbba97ab2517446e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe

Filesize
468KB

MD5
c8f0b57818a712245d930bc46721cbae

SHA1
138b7a84fbe0b5af6a8c31753e958ea4731c4d0e

SHA256
6058c1e6efab1c4c460ecbbbe79ed07cfeb9d9a103976e3e3af1889983ec7a3e

SHA512
079422d90cd323752f5d105dcfb0a7861b14e12040e0b2ad9c8c80dff5c33bb34301b3363c56b318acd5df5e09a218410aa8f3320aaebbb689dc3e38843217ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe

Filesize
468KB

MD5
d0e1b082f15976ceeabf01ab27ad5589

SHA1
4e531cb1f5b9087770e2559b231d4275d80f4a8d

SHA256
ba2581edc02337ad0a5c330be160ed5275bd7b03fda0388a0bb8d33b4eb22263

SHA512
29288768525e97bc076577d6b27df2c99bb9e7f89d0f9ea90e492c7ef8c5a8066dfbd13bbe663c3cfbda1308f5a608ac4cf5bd081e2f00ef97a3114fb361546a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe

Filesize
468KB

MD5
81ea760c78a9d61b018dedfd42e5656e

SHA1
07e23c979e80b527e2871243a405b5ea63d10dc9

SHA256
4b58ae3be8d10c2c5241b8a75e81a8efa9adc0b5066397597b75a5e7c60e38a7

SHA512
5290a19cc4a1e5a345915c27f14973abaf0348dc1756c5f6bb1f6233176b3d044c395e65310e52059883cef1d368abd99a020da1fdd4bd901a8d56cb971a7c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe

Filesize
468KB

MD5
be3a39b74594ffcfb21f75dd45b80d34

SHA1
7c033967d7d41e2715ed554a6106a4334707fd88

SHA256
0611dbf705db405b6c11f246c626a4c74dae8a8ffe103f30d992a69b693d8056

SHA512
7e3eae8275c953f5db7e41f9b7f0013325562594c34dace095a252be2d5702d4f4f95496024a38ffa1b8b0b2e2d32a948d4a01debe4a6b084854cb6986b6ad19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe

Filesize
468KB

MD5
ca2ffee4f7054cad3d4f9477ccc948d8

SHA1
507534608a67036fc8be7dac9c765e8def652d14

SHA256
ddef426d42864c655bcddc610ea0c6de60efabd7f776f400338f533bc3f45c19

SHA512
2ff6c64042d6c36c5e2f627f955a54a7a10bbbed85e0e37c6615b2f83673f467930554323b1fa07daac82ee3d1203119db07553bb1af83d540bfa9c8678afab4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe

Filesize
468KB

MD5
8d7be551e66c2a1471b25b047897a1ac

SHA1
e45537b550498ffa525626c805aa15ededb9ee05

SHA256
ea01192275ae96e6f26f36979c29009e56e05a121cd9374a0075d4e1e691bd1e

SHA512
3fc623375ceb8af2bd851f165bf971f4985778603287cba468da13614ccbbf224bc0968b6fe8b3ed8aa7d450a3d6b9fbe39befe6bec3bb8ecfad464298a1fe2c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe

Filesize
468KB

MD5
5a5df6b335b2958b0425805d08f7ec88

SHA1
c511fdf5d8b36ddd4916132f5e1d8e25e254c654

SHA256
119fd6b578d00eb0f09059072302d49416492c30ecdcffc7cd00aaa73d7f3c6f

SHA512
46607cf96b713536461b6c7f86976b066bbb552aba593e42dc589b310b28b0fdb4205414472954b95bee4ec26ac5b4ce05f77d88700b63c59e0948905f5d5ffa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe

Filesize
468KB

MD5
fe956e3c840969fb179527d43a764df8

SHA1
270aa26566de27d210c2263b0468f885ea7aa982

SHA256
e78f642374bfe88b2e54073324006f9a95597eb10e335b2ef3fc1025082b2b3b

SHA512
71a5ee157f70b583f269690941adc7a7c27e75d88eaae57315bcb087c2a4ad37500fc8d9d1b97dcf9e022080c2b4f71851a3742b1fb2aa73c5204457832a171e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe

Filesize
468KB

MD5
6baec9a2c766aad044dfdfb1e4806ddc

SHA1
c14845108592fa33b59ceedfe25ac5312cfc0f03

SHA256
400987bb0df07b0ced9da6eb0b941cb54841b4f64be305f582b206b1ec223516

SHA512
98cfa6e39ab40f84c8b6c7593a34bb2c7049a24f22cde6afad743b0d522fd90e74f3b1267ef96d1ae1a6deada36cc0bd0c1d00ad1b588336e55a3f531ec06d11

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe

Filesize
468KB

MD5
3070f6b4703a33c8f26536b275c8059b

SHA1
6f3875c00f23cbbf3a13fea4ae010304ba0dd525

SHA256
4205e9afeb42d133189817c12e9da14636748383de28e714083c54565d3dca27

SHA512
1d45ef4deb503146ad6c469a3bf3914807d21abe6a12b438a8c072a8ced90d08f02b066ab3b184baf543de0dd28a663c0002e9e41cd99ee885b7110c322b759d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe

Filesize
468KB

MD5
7b7a88225c4308b988499d91842de15d

SHA1
cdab4fe81faff02e58bd0f658be876bb60d3a12e

SHA256
50f66c87bf2a7c784e54d69aa1acb56ea19b72d27ff38072dbf668057657639f

SHA512
f3a1dc1dfa7b32c34fb6c0dc9ed16af92e70e1e4bad97a6871267578cb758d8dd1d08e5d98928a9b9a7425c4fe4e7cc844de6af7bb68730850e89f19eff21aeb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe

Filesize
468KB

MD5
8a09d81710617541eff93b803307e5ff

SHA1
758d68d97b835d795d70ea8638f105d0a2c44db7

SHA256
990b1dd64c2e7ac3cad95699e03d5bd3dd0b904022959e4d50dbdb30f9a84a87

SHA512
a4f3e3cf4d1aa3dc3e54e5bca038cf1c6cbdaf10d7fc20c320404ae9f3784bf3f892b5b62c9d92593d93e717ffa3c610b0657b4e2ba168fe678c45298417acbb

Download Submit
memory/396-409-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/396-36-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/396-404-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/396-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-37-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/396-224-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/396-225-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/396-6-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/396-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-176-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/892-180-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/892-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/948-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-348-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1004-347-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1188-364-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1188-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-177-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1188-378-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1464-377-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1464-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-329-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1524-330-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1524-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-289-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1532-293-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1904-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-403-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/1992-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-211-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2132-208-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2132-398-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2132-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-334-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2172-338-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2172-257-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2172-256-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2192-236-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2192-229-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2192-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-159-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2248-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-305-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2248-76-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2248-306-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2428-320-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2428-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-321-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2480-405-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2480-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-397-0x00000000023B0000-0x0000000002425000-memory.dmp

Filesize
468KB

Download
memory/2552-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-216-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2552-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-209-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2552-19-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2552-399-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2564-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-352-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2600-358-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2684-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-215-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2808-285-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2808-146-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2808-286-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2808-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-145-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2864-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-319-0x00000000007A0000-0x0000000000815000-memory.dmp

Filesize
468KB

Download
memory/2908-210-0x00000000007A0000-0x0000000000815000-memory.dmp

Filesize
468KB

Download
memory/2908-213-0x00000000007A0000-0x0000000000815000-memory.dmp

Filesize
468KB

Download
memory/2908-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-380-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2948-129-0x00000000034E0000-0x0000000003555000-memory.dmp

Filesize
468KB

Download
memory/2948-137-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2948-367-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2948-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-275-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2948-276-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/3064-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-273-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/3064-274-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download