c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
Size

468KB
MD5

4b826915efcce5b7132b6de867113efb
SHA1

2c6056c7e1fe3a024640555e155cb5e967e4897f
SHA256

c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9
SHA512

b12959cb36d1d9fd59ddb3d630131c6623d890e928c780f2b63f56936cc9df95d3f8ed175380a6e859318bc9d48c96b081c975e554b70aa32f75dee527558ccf
SSDEEP

3072:tTzDogZdPT842bYaZbi/9f8/WfFjtIp40dHGsVp71J6382dN/XlB:tTfoWg429ZW/9fx0Mi1JYrdN/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2948	Unicorn-54488.exe
2076	Unicorn-46201.exe
2648	Unicorn-27404.exe
2972	Unicorn-16525.exe
2804	Unicorn-35322.exe
2652	Unicorn-30919.exe
2676	Unicorn-37050.exe
2800	Unicorn-29017.exe
1868	Unicorn-27401.exe
3060	Unicorn-859.exe
956	Unicorn-18047.exe
1556	Unicorn-63718.exe
940	Unicorn-17781.exe
2628	Unicorn-58747.exe
692	Unicorn-5633.exe
1912	Unicorn-56562.exe
2980	Unicorn-4760.exe
2192	Unicorn-24321.exe
1172	Unicorn-62120.exe
1060	Unicorn-14803.exe
1744	Unicorn-31607.exe
1676	Unicorn-28954.exe
2348	Unicorn-25476.exe
1400	Unicorn-48820.exe
932	Unicorn-11741.exe
1856	Unicorn-56693.exe
2400	Unicorn-20938.exe
1716	Unicorn-65051.exe
2468	Unicorn-5644.exe
2136	Unicorn-53319.exe
2752	Unicorn-55587.exe
2736	Unicorn-7564.exe
2588	Unicorn-43007.exe
2660	Unicorn-29324.exe
2180	Unicorn-62297.exe
2172	Unicorn-20383.exe
2004	Unicorn-19423.exe
3016	Unicorn-13676.exe
1708	Unicorn-26904.exe
1872	Unicorn-52370.exe
1392	Unicorn-52370.exe
564	Unicorn-36501.exe
1628	Unicorn-53919.exe
1056	Unicorn-2117.exe
2188	Unicorn-35833.exe
1320	Unicorn-25051.exe
276	Unicorn-4779.exe
2448	Unicorn-26104.exe
1516	Unicorn-1257.exe
1980	Unicorn-64024.exe
2300	Unicorn-20416.exe
2260	Unicorn-54781.exe
2836	Unicorn-37988.exe
2488	Unicorn-37869.exe
1508	Unicorn-24029.exe
536	Unicorn-15628.exe
936	Unicorn-39981.exe
2696	Unicorn-2134.exe
2868	Unicorn-2413.exe
2776	Unicorn-40640.exe
2336	Unicorn-25082.exe
2540	Unicorn-5481.exe
1484	Unicorn-8818.exe
1144	Unicorn-36508.exe

Loads dropped DLL 64 IoCs

pid	Process
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
2948	Unicorn-54488.exe
2948	Unicorn-54488.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
2948	Unicorn-54488.exe
2948	Unicorn-54488.exe
2076	Unicorn-46201.exe
2076	Unicorn-46201.exe
2648	Unicorn-27404.exe
2648	Unicorn-27404.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
2972	Unicorn-16525.exe
2972	Unicorn-16525.exe
2948	Unicorn-54488.exe
2948	Unicorn-54488.exe
2804	Unicorn-35322.exe
2804	Unicorn-35322.exe
2648	Unicorn-27404.exe
2652	Unicorn-30919.exe
2648	Unicorn-27404.exe
2652	Unicorn-30919.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
2800	Unicorn-29017.exe
2800	Unicorn-29017.exe
2972	Unicorn-16525.exe
2972	Unicorn-16525.exe
2076	Unicorn-46201.exe
2076	Unicorn-46201.exe
2676	Unicorn-37050.exe
2676	Unicorn-37050.exe
1868	Unicorn-27401.exe
1868	Unicorn-27401.exe
2948	Unicorn-54488.exe
2948	Unicorn-54488.exe
956	Unicorn-18047.exe
956	Unicorn-18047.exe
2648	Unicorn-27404.exe
3060	Unicorn-859.exe
940	Unicorn-17781.exe
2804	Unicorn-35322.exe
2652	Unicorn-30919.exe
2648	Unicorn-27404.exe
940	Unicorn-17781.exe
3060	Unicorn-859.exe
2804	Unicorn-35322.exe
2652	Unicorn-30919.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
692	Unicorn-5633.exe
692	Unicorn-5633.exe
2972	Unicorn-16525.exe
2628	Unicorn-58747.exe
2972	Unicorn-16525.exe
2628	Unicorn-58747.exe
2800	Unicorn-29017.exe
2800	Unicorn-29017.exe
2192	Unicorn-24321.exe
2192	Unicorn-24321.exe
1556	Unicorn-63718.exe
1556	Unicorn-63718.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2264	1556	WerFault.exe	39
2708	2660	WerFault.exe	62
696	2736	WerFault.exe	60
3692	2224	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58853.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
2948	Unicorn-54488.exe
2076	Unicorn-46201.exe
2648	Unicorn-27404.exe
2972	Unicorn-16525.exe
2804	Unicorn-35322.exe
2676	Unicorn-37050.exe
2652	Unicorn-30919.exe
2800	Unicorn-29017.exe
1868	Unicorn-27401.exe
956	Unicorn-18047.exe
3060	Unicorn-859.exe
1556	Unicorn-63718.exe
940	Unicorn-17781.exe
692	Unicorn-5633.exe
2628	Unicorn-58747.exe
1912	Unicorn-56562.exe
2192	Unicorn-24321.exe
1172	Unicorn-62120.exe
1060	Unicorn-14803.exe
2980	Unicorn-4760.exe
1400	Unicorn-48820.exe
932	Unicorn-11741.exe
2348	Unicorn-25476.exe
1744	Unicorn-31607.exe
1676	Unicorn-28954.exe
1856	Unicorn-56693.exe
2400	Unicorn-20938.exe
2468	Unicorn-5644.exe
1716	Unicorn-65051.exe
2752	Unicorn-55587.exe
2136	Unicorn-53319.exe
2736	Unicorn-7564.exe
2588	Unicorn-43007.exe
2660	Unicorn-29324.exe
1872	Unicorn-52370.exe
2180	Unicorn-62297.exe
1708	Unicorn-26904.exe
1392	Unicorn-52370.exe
2172	Unicorn-20383.exe
3016	Unicorn-13676.exe
2004	Unicorn-19423.exe
1056	Unicorn-2117.exe
564	Unicorn-36501.exe
1628	Unicorn-53919.exe
2188	Unicorn-35833.exe
1320	Unicorn-25051.exe
276	Unicorn-4779.exe
2448	Unicorn-26104.exe
1516	Unicorn-1257.exe
1980	Unicorn-64024.exe
2300	Unicorn-20416.exe
2260	Unicorn-54781.exe
536	Unicorn-15628.exe
2488	Unicorn-37869.exe
2836	Unicorn-37988.exe
2868	Unicorn-2413.exe
1508	Unicorn-24029.exe
2696	Unicorn-2134.exe
936	Unicorn-39981.exe
2776	Unicorn-40640.exe
2540	Unicorn-5481.exe
1484	Unicorn-8818.exe
2336	Unicorn-25082.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2948	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	29
PID 1756 wrote to memory of 2948	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	29
PID 1756 wrote to memory of 2948	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	29
PID 1756 wrote to memory of 2948	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	29
PID 2948 wrote to memory of 2076	2948	Unicorn-54488.exe	30
PID 2948 wrote to memory of 2076	2948	Unicorn-54488.exe	30
PID 2948 wrote to memory of 2076	2948	Unicorn-54488.exe	30
PID 2948 wrote to memory of 2076	2948	Unicorn-54488.exe	30
PID 1756 wrote to memory of 2648	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	31
PID 1756 wrote to memory of 2648	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	31
PID 1756 wrote to memory of 2648	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	31
PID 1756 wrote to memory of 2648	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	31
PID 2948 wrote to memory of 2972	2948	Unicorn-54488.exe	32
PID 2948 wrote to memory of 2972	2948	Unicorn-54488.exe	32
PID 2948 wrote to memory of 2972	2948	Unicorn-54488.exe	32
PID 2948 wrote to memory of 2972	2948	Unicorn-54488.exe	32
PID 2076 wrote to memory of 2804	2076	Unicorn-46201.exe	33
PID 2076 wrote to memory of 2804	2076	Unicorn-46201.exe	33
PID 2076 wrote to memory of 2804	2076	Unicorn-46201.exe	33
PID 2076 wrote to memory of 2804	2076	Unicorn-46201.exe	33
PID 2648 wrote to memory of 2676	2648	Unicorn-27404.exe	34
PID 2648 wrote to memory of 2676	2648	Unicorn-27404.exe	34
PID 2648 wrote to memory of 2676	2648	Unicorn-27404.exe	34
PID 2648 wrote to memory of 2676	2648	Unicorn-27404.exe	34
PID 1756 wrote to memory of 2652	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	35
PID 1756 wrote to memory of 2652	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	35
PID 1756 wrote to memory of 2652	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	35
PID 1756 wrote to memory of 2652	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	35
PID 2972 wrote to memory of 2800	2972	Unicorn-16525.exe	36
PID 2972 wrote to memory of 2800	2972	Unicorn-16525.exe	36
PID 2972 wrote to memory of 2800	2972	Unicorn-16525.exe	36
PID 2972 wrote to memory of 2800	2972	Unicorn-16525.exe	36
PID 2948 wrote to memory of 1868	2948	Unicorn-54488.exe	37
PID 2948 wrote to memory of 1868	2948	Unicorn-54488.exe	37
PID 2948 wrote to memory of 1868	2948	Unicorn-54488.exe	37
PID 2948 wrote to memory of 1868	2948	Unicorn-54488.exe	37
PID 2804 wrote to memory of 3060	2804	Unicorn-35322.exe	38
PID 2804 wrote to memory of 3060	2804	Unicorn-35322.exe	38
PID 2804 wrote to memory of 3060	2804	Unicorn-35322.exe	38
PID 2804 wrote to memory of 3060	2804	Unicorn-35322.exe	38
PID 2648 wrote to memory of 1556	2648	Unicorn-27404.exe	39
PID 2648 wrote to memory of 1556	2648	Unicorn-27404.exe	39
PID 2648 wrote to memory of 1556	2648	Unicorn-27404.exe	39
PID 2648 wrote to memory of 1556	2648	Unicorn-27404.exe	39
PID 2652 wrote to memory of 956	2652	Unicorn-30919.exe	40
PID 2652 wrote to memory of 956	2652	Unicorn-30919.exe	40
PID 2652 wrote to memory of 956	2652	Unicorn-30919.exe	40
PID 2652 wrote to memory of 956	2652	Unicorn-30919.exe	40
PID 1756 wrote to memory of 940	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	41
PID 1756 wrote to memory of 940	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	41
PID 1756 wrote to memory of 940	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	41
PID 1756 wrote to memory of 940	1756	c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe	41
PID 2800 wrote to memory of 2628	2800	Unicorn-29017.exe	42
PID 2800 wrote to memory of 2628	2800	Unicorn-29017.exe	42
PID 2800 wrote to memory of 2628	2800	Unicorn-29017.exe	42
PID 2800 wrote to memory of 2628	2800	Unicorn-29017.exe	42
PID 2972 wrote to memory of 692	2972	Unicorn-16525.exe	43
PID 2972 wrote to memory of 692	2972	Unicorn-16525.exe	43
PID 2972 wrote to memory of 692	2972	Unicorn-16525.exe	43
PID 2972 wrote to memory of 692	2972	Unicorn-16525.exe	43
PID 2676 wrote to memory of 1912	2676	Unicorn-37050.exe	45
PID 2676 wrote to memory of 1912	2676	Unicorn-37050.exe	45
PID 2676 wrote to memory of 1912	2676	Unicorn-37050.exe	45
PID 2676 wrote to memory of 1912	2676	Unicorn-37050.exe	45

C:\Users\Admin\AppData\Local\Temp\c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe
"C:\Users\Admin\AppData\Local\Temp\c9846199ef569d0afc041a4eacda02c05645c3c973e6359cd8b81d853e9d7fb9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-859.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 200
        8⤵
        Program crash
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        7⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        6⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        6⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31681.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
        7⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        6⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8228.exe
        6⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        6⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47446.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4760.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24519.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
        5⤵
        
        PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        5⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
      4⤵
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
      4⤵
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
      4⤵
      PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11303.exe
        8⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        8⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        7⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50038.exe
        6⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38717.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
        7⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        6⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-438.exe
        6⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23768.exe
        7⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60155.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        6⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        6⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1714.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40534.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
        5⤵
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65051.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        5⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
      4⤵
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
      4⤵
      PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27362.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
        6⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43212.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        5⤵
        
        PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21365.exe
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exe
      4⤵
      PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61305.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
      4⤵
      PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64024.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3327.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
    3⤵
    PID:5384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37050.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        6⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        6⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49015.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41062.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
        5⤵
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24839.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        6⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13676.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        5⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18992.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
      4⤵
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34865.exe
        5⤵
        
        PID:1832
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 236
        5⤵
        Program crash
        
        PID:696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 236
      4⤵
      Program crash
      PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49015.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39993.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15708.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      4⤵
      PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49224.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
      4⤵
      PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12959.exe
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
    3⤵
    PID:4432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18047.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 240
        6⤵
        Program crash
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        5⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40064.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        5⤵
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      4⤵
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
      4⤵
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        5⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
      4⤵
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
      4⤵
      PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54781.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        5⤵
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49015.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46238.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57682.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40223.exe
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54610.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
      4⤵
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37988.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45038.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
    3⤵
    PID:6080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32887.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
      4⤵
      PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5481.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57501.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
    3⤵
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30904.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
    3⤵
    PID:5820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
      4⤵
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
      4⤵
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11601.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
      4⤵
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
    3⤵
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
    3⤵
    PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
    3⤵
    PID:5256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26904.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
    3⤵
    PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6117.exe
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
    3⤵
    PID:5768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
    3⤵
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19247.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
      4⤵
      PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
    3⤵
    PID:2500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
  2⤵
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
  2⤵
  PID:1240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7198.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7198.exe
  2⤵
  PID:3856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
  2⤵
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
  2⤵
  PID:5172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe

Filesize
468KB

MD5
9921eaa3b43067bc082fd02c7881e40e

SHA1
dab6bbb044e3f65f607c85ddf5139581e044b6e6

SHA256
3e004366b2a61c18ccc749d033caefff9abd26324535a51c172fd1ca27d44add

SHA512
08e104438c590be0daa988f6b4934f5bdec545b3bca1983d96d62ce8dd648dcab5ff64f5c281aea81199b12ff1d85d84686d4d9e150daf36aba818fe3a9b2f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe

Filesize
468KB

MD5
f7f324c45a09ab789c950576ea353dff

SHA1
11bebda5c9cab343b35a911bbe04a786563bfaf5

SHA256
ba489e169fd30f8b6a7bd99a264e1336881d3a6655baa387bcc66a0bfda0fa4e

SHA512
db840040e476fbe4348d1a64ce4085f8c73b0173026520b49cfbd5c0f1d3d0890628fec005d77376de740b447c74cb1969ed019fca7bd54a9d9e7f253c43a993

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe

Filesize
468KB

MD5
e0c5225ddb7c807e21ad34361bad2fac

SHA1
0a8aff61fbd283a07e6de565fb88aedccdfac7aa

SHA256
d77c5f61aa03468d15fa93113233047191137dfaf3e55977df0f750536c683aa

SHA512
b79e17487da92a59f49201caa09d92f6b6dc4f3ba99b4acc547f316cb820b09526a6204e50edaab5f27f5476bed11f268a1b0c2a6bc74c0f473d52d3bcfee423

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe

Filesize
468KB

MD5
efb51ce6390114796ddaa072a7b93c47

SHA1
e415472394c9dce9c65dcc45060f562f9aba3af4

SHA256
712e32e9f28e78053f5e266ae3098b05d63dff6c6cd9621b35a128fd9088785c

SHA512
65978ff7689239d5072b9f9eda4ba093c6650b050a439526b9454cb0638340600621df4b6ccbe956ac4c39d8fb6f19a420c29ebde87d3cd124c4a7eaf564f141

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe

Filesize
468KB

MD5
44528dd1aaa97c5ebf925ce14cfe5ef0

SHA1
e4a243f0cb2f6336bba38c0072395927d7e45150

SHA256
fe8c5cb3458a6f207e49c5d1fd5097756ae55183836d831e779e7cf47fc95d42

SHA512
1dbdaa7746da8011bbe7f52eb6695d901aa231526aaaf02c4b799adfb6516e70a891db8d5c034bfd151180afe5cd18b40a198e1684fed38b834ffece15f22e2a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe

Filesize
468KB

MD5
6f0ebac9c3f0e10c8f96190e3cf09481

SHA1
31f00f248cb1581f99f8277cb578b1472241a33b

SHA256
bdb04ddf672810903507943562702828f547a8735cd078c8640f2851be046f66

SHA512
c50cbfe08f5264d95b9c391c99e7864d03e5c26f9f76ba0ba8c4aecc2954c7f411fa8e25e8c98348498b62728e411b897cc88a45006c74e219651107081ac4c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe

Filesize
468KB

MD5
4d8a453fe1faee390e668549345dbd10

SHA1
2ffa7158d167778973d61e82c3fe877a3b33c476

SHA256
b116b4bfa481d7ca91a90882eae7d7e78ec6a79b0d42b8890af82a1b11b16372

SHA512
abd3107eeaff7e3fa817439717e609f915c962a628eda3db7e24406a5ea406a88ead8b20487e00997787341b19f76160d279513596cef9703bb876096417faa2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18047.exe

Filesize
468KB

MD5
754097fa6851616df186cc20be12e47f

SHA1
8e9d70f71f9e34631eb7442d78b43a55749fc456

SHA256
a06b8a8d46b865df1a0142b4b316f5b18769e46f5d441ca351716978059675ac

SHA512
5a0a2e4a1e87ae84195f009b92946a0ab0d128d5ec10d641bfd6cecb20993e379e6d59efeba0ec9dfa348bcb3f85b5ebe581a97a94c7a94da0e163618fc4ad04

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe

Filesize
468KB

MD5
a73ebbba64565df61aab0716300e1cc3

SHA1
409ee2c728bb0b3ec9d5fa0de0aa37127f1806de

SHA256
6c781168e2f1fd9330fce060704ee80b184dadc477767669d76cee885834c58d

SHA512
a35e8ef2494fcda230f55b39baface6bced826edab734a3ea14aa716e1bf37fc419f8e7b44dfd3c054be39141718f922b7a0f4d2744dafc7202b543948852475

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe

Filesize
468KB

MD5
325c558e031f5df7cdd066f8c3c2313e

SHA1
3042246842105de61634f90a1cdad387b75cc65b

SHA256
cbfae5fef65ba86340219ce05bf90fd4df1b450d94fd550c03e397784c117877

SHA512
565d8756ec8932b00f2c44c5331cba54d668d3cbad0ab690bab5befb220b4c6966ec7eda3c1c55273256dae2ffd534428a6b33239e38161165c088a2c164557e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe

Filesize
468KB

MD5
2241f7a483ab5006f76f11f4d593b97e

SHA1
b956b6097119b0fb8e1fc2862e4f79a5774af036

SHA256
4d415c7b7d00d5b936f6d9e58c6c1f1ed4150d7933e554ff04bb4886c9ba4be5

SHA512
467429c9f6331940fad6f08c527b44dcc760bb8b6c932b2755dd3346a675f3caa237fe21bb642c58b5b85f4a15bd6bedd40930888f6dfba2023e4563828a466e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe

Filesize
468KB

MD5
dd1c07b21e8a8d149582030ae1e075f8

SHA1
684a5f3b4316e16dfb41f378bfa31f6a3a5e910f

SHA256
278c6b53b24cadbf14cdd35b6a6e98296e2359c3fc7fe90f32e32b6e794b31fa

SHA512
35a1243aa741f7093ca2593d3ae0e4adfa846893ded4182c894b983dcec9887e76ec1e8981cc8096dc2575628e9eced823f908f709981fae012d28e128a72f1c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe

Filesize
468KB

MD5
d061a03f2df5199a7bee7a29c2f066dd

SHA1
4fd7a1079f008436625a82f41bad74d1e0f5fb33

SHA256
724a21b611d8f7f6e047415972f70d14c2b41a7526a37d9bd835090ceb6e562a

SHA512
e57c3e7ab84a50dd88a01c7497cab0393d5be089910dbf1a89a12489cec5516c4785180d1526a1dac64a1f95e9e20be24ae8152aecc28a324d14858d5b04b1d3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe

Filesize
468KB

MD5
c5e82d4f79789f78055ad880ec0fbe0b

SHA1
0f9375c451a5bf093bc372d2c35f8f03c7215aa5

SHA256
f0c0eebec8d73665983124b99b370c81bc29e1a555dda661ae4edd21892c2e45

SHA512
43d87391b759d8911cf56b0cc615f910b1179049df725c79f47b5681d245de2f1dc6a7eb1f096168d258540d447dedd7effd26d34e9e10c1c662e3324b17a6c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37050.exe

Filesize
468KB

MD5
f02db21249447804b865c7bbc9926b09

SHA1
1edc30fe6b60c698635d444f3c5d036395125d71

SHA256
f5bc2190319443d86f9675e5b14339e4e7d475e00be26cb5f4bb43b4529ac17c

SHA512
8a887fa8af5dc574df5d370949fa4b379a00b297a81050f5e7e7a045d21458ec19817f9cea0bac99a3c56b21bf43f245293550a82d5d53abffd85234820c5503

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe

Filesize
468KB

MD5
a5d809a74d59bda606d23e4bfe6caedf

SHA1
b01c418e241a4620b51c8d35d6083e5e6eafdef1

SHA256
373b1ff2046eb96ef1fe6fdbcdbd7e24c5893118ff2175111fb6e2baea7c34fb

SHA512
a006f65ea8ca6967e22ef285f4fabc42b6608d545faeed6f78102afcdeab6bf2b7913bc8706ecd1a46136db7f2edb1cff7c7a7c092a1ae3dc67a92eb1595112e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4760.exe

Filesize
468KB

MD5
56b2dabd59d98bb8657b8812e946aced

SHA1
0ebc924ea311ddb8123f60c3f548439cf4b95a6c

SHA256
40297e1478ac4329026a3b38b290d2861eb10659b43c776ff18f88d820fdb76e

SHA512
cfbe2ea61cc991bada614222e80d339b4ec6b087928778e658d24e880422a080488abf67a7f1289e9f4da622dd85f370341367eb42dc94c55f8c34e192b9c83f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe

Filesize
468KB

MD5
b77e901e7d0e84eb287df7023f8a0992

SHA1
68656d2648814c86c2e44b18af4400000ce35a78

SHA256
16c78fc66d1ae8e33905cd34d1f32b04576bd8ad97a496a9dd044fa964825ee3

SHA512
59593dc0e9ca54221989481b16f403218d456e7fb576eee59301cd8f9b02f74e393529f9c1d01188fad81c2eddf92ac9d79cf924adc5b87462fe4e6bc6d15736

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe

Filesize
468KB

MD5
e99f96037e76f0fdd6c2ea8e6cc3c764

SHA1
0692e6895690551c9de1b2d505a54f9fba1c2397

SHA256
a832593397868bcc6085f04f66683f5e076e929fc0fa30dfe78b30b048fff232

SHA512
fbd99e83d6c8d8ca7c2768dab6ba4b1fd7750d8d806c6c17d2d2f20ff59d096d26946f29f47f978f7447047d82dddfbeb951f802d6d2f02c1fe5f14c1111aa81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe

Filesize
468KB

MD5
8f80bfc703507a0c28ee48029d716ad5

SHA1
98d595ede907d1e3c0dc6ca9de33ab03ba818d33

SHA256
50c00fb1a11dfb95ab502015dee7de33a2db02bc97c0a0c9721ae920f0d10d82

SHA512
07c324cf181c1a0340349a6a0423cadb3435f2ade7ae8e64d11f542fbd989afc0a080629deccf5ce3dd291d8fb2760d62b03642df1f37e1765b8a5e137219649

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-859.exe

Filesize
468KB

MD5
7bbfb97bc85df068c609caa7d32f7c75

SHA1
c6b6f886e8cbbc6fb19a3dcd8909be07d35c1417

SHA256
ef852fd70d846d794390ebc714d6e16084fa672ee525b5967484b5332836aabd

SHA512
499330435eb5dc681762c3ef55d9554385da1df54227feb19b79828b4e2a40b2c2a03f97137bf7ea735e22cedd9ea8d43edc0f3d96e99cbbab84ab3ed819887c

Download Submit
memory/692-311-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/692-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/692-307-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/932-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-275-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/940-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-273-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/956-238-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/956-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-243-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/956-396-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/1060-387-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/1060-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-366-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1556-367-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1676-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-150-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1756-430-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1756-155-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1756-294-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1756-293-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1756-10-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1756-11-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1856-418-0x0000000002780000-0x00000000027F5000-memory.dmp

Filesize
468KB

Download
memory/1856-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-374-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/1868-223-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/1868-378-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/1868-222-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/1912-407-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1912-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-400-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2004-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-206-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2076-214-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2136-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-351-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2192-355-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2348-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-329-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2628-330-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2628-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-146-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2648-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2648-259-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2648-140-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2652-144-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2652-278-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2652-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-141-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2652-274-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2660-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-210-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/2676-211-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/2676-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-419-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/2736-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-174-0x0000000003440000-0x00000000034B5000-memory.dmp

Filesize
468KB

Download
memory/2800-347-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2800-175-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2800-348-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2804-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-277-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2804-283-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2948-48-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2948-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-26-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2948-229-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2948-107-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2948-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-181-0x0000000003430000-0x00000000034A5000-memory.dmp

Filesize
468KB

Download
memory/2972-186-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2972-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-320-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2972-332-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/3016-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-282-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/3060-285-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download