27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
Size

468KB
MD5

6bd64abef25f610ebf6d7e5ed09dc2f9
SHA1

ccba2016dcc925bd176061930b5e2c22b2fb6a36
SHA256

27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851
SHA512

a0f457ddeabac8df58ce8a5da4b84e5299dc823d289313a49a6e3d827440e4611e6c855322ce5d274fbca111cdf646feab530b65e00486a43dbe6c7a49d369c6
SSDEEP

3072:vNacogdRjL8I2bYgPz3yqf8/aChjnIpfPmHxjTHMGTl+dYvREHle:vN9omoI2XPDyqfQ0akGTAuvRE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2224	Unicorn-38307.exe
2220	Unicorn-22630.exe
2008	Unicorn-57995.exe
2152	Unicorn-38857.exe
2816	Unicorn-4046.exe
2840	Unicorn-29681.exe
2876	Unicorn-19104.exe
264	Unicorn-42531.exe
1192	Unicorn-37631.exe
3056	Unicorn-5089.exe
2664	Unicorn-52244.exe
980	Unicorn-39900.exe
1340	Unicorn-29329.exe
2120	Unicorn-54845.exe
1496	Unicorn-58374.exe
1424	Unicorn-59586.exe
1876	Unicorn-58003.exe
820	Unicorn-6685.exe
2776	Unicorn-6685.exe
2700	Unicorn-555.exe
2552	Unicorn-5543.exe
1712	Unicorn-49555.exe
2604	Unicorn-28180.exe
2628	Unicorn-6384.exe
1748	Unicorn-49939.exe
544	Unicorn-49939.exe
1828	Unicorn-30073.exe
1736	Unicorn-36103.exe
1740	Unicorn-33219.exe
2424	Unicorn-27088.exe
2936	Unicorn-60529.exe
2952	Unicorn-34349.exe
2896	Unicorn-54215.exe
2940	Unicorn-54215.exe
2976	Unicorn-54215.exe
2572	Unicorn-27884.exe
3040	Unicorn-44464.exe
2512	Unicorn-28149.exe
1316	Unicorn-27957.exe
1968	Unicorn-8091.exe
916	Unicorn-60883.exe
1652	Unicorn-15211.exe
1460	Unicorn-60136.exe
556	Unicorn-21048.exe
2124	Unicorn-19056.exe
2472	Unicorn-5180.exe
912	Unicorn-7894.exe
900	Unicorn-46524.exe
2648	Unicorn-38521.exe
1004	Unicorn-7702.exe
2208	Unicorn-62933.exe
632	Unicorn-55320.exe
1820	Unicorn-1215.exe
888	Unicorn-1480.exe
1624	Unicorn-43643.exe
2036	Unicorn-57287.exe
3048	Unicorn-473.exe
3068	Unicorn-14208.exe
2928	Unicorn-16922.exe
2828	Unicorn-27137.exe
1692	Unicorn-45419.exe
1132	Unicorn-14692.exe
2332	Unicorn-14692.exe
1040	Unicorn-60364.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
2224	Unicorn-38307.exe
2224	Unicorn-38307.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
2008	Unicorn-57995.exe
2220	Unicorn-22630.exe
2008	Unicorn-57995.exe
2220	Unicorn-22630.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
2224	Unicorn-38307.exe
2224	Unicorn-38307.exe
2152	Unicorn-38857.exe
2152	Unicorn-38857.exe
2220	Unicorn-22630.exe
2220	Unicorn-22630.exe
2840	Unicorn-29681.exe
2840	Unicorn-29681.exe
2224	Unicorn-38307.exe
2224	Unicorn-38307.exe
2816	Unicorn-4046.exe
2876	Unicorn-19104.exe
2008	Unicorn-57995.exe
2008	Unicorn-57995.exe
2876	Unicorn-19104.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
2816	Unicorn-4046.exe
264	Unicorn-42531.exe
264	Unicorn-42531.exe
2152	Unicorn-38857.exe
2152	Unicorn-38857.exe
1192	Unicorn-37631.exe
2664	Unicorn-52244.exe
1192	Unicorn-37631.exe
2664	Unicorn-52244.exe
2220	Unicorn-22630.exe
2220	Unicorn-22630.exe
2224	Unicorn-38307.exe
2224	Unicorn-38307.exe
1340	Unicorn-29329.exe
1340	Unicorn-29329.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
1496	Unicorn-58374.exe
1496	Unicorn-58374.exe
2120	Unicorn-54845.exe
980	Unicorn-39900.exe
2120	Unicorn-54845.exe
980	Unicorn-39900.exe
2816	Unicorn-4046.exe
2816	Unicorn-4046.exe
2876	Unicorn-19104.exe
2876	Unicorn-19104.exe
1876	Unicorn-58003.exe
2008	Unicorn-57995.exe
1876	Unicorn-58003.exe
2008	Unicorn-57995.exe
2152	Unicorn-38857.exe
2152	Unicorn-38857.exe
2840	Unicorn-29681.exe
2840	Unicorn-29681.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5140	5108	WerFault.exe	384
5136	4116	WerFault.exe	389

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55623.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
2224	Unicorn-38307.exe
2220	Unicorn-22630.exe
2008	Unicorn-57995.exe
2152	Unicorn-38857.exe
2816	Unicorn-4046.exe
2840	Unicorn-29681.exe
2876	Unicorn-19104.exe
264	Unicorn-42531.exe
1192	Unicorn-37631.exe
2664	Unicorn-52244.exe
980	Unicorn-39900.exe
1496	Unicorn-58374.exe
2120	Unicorn-54845.exe
3056	Unicorn-5089.exe
1340	Unicorn-29329.exe
1424	Unicorn-59586.exe
1876	Unicorn-58003.exe
2700	Unicorn-555.exe
820	Unicorn-6685.exe
2776	Unicorn-6685.exe
2552	Unicorn-5543.exe
2628	Unicorn-6384.exe
2604	Unicorn-28180.exe
1748	Unicorn-49939.exe
1712	Unicorn-49555.exe
2424	Unicorn-27088.exe
2952	Unicorn-34349.exe
1828	Unicorn-30073.exe
544	Unicorn-49939.exe
1736	Unicorn-36103.exe
3040	Unicorn-44464.exe
1740	Unicorn-33219.exe
2976	Unicorn-54215.exe
2896	Unicorn-54215.exe
2940	Unicorn-54215.exe
2572	Unicorn-27884.exe
2936	Unicorn-60529.exe
1316	Unicorn-27957.exe
2512	Unicorn-28149.exe
1968	Unicorn-8091.exe
1652	Unicorn-15211.exe
1460	Unicorn-60136.exe
916	Unicorn-60883.exe
556	Unicorn-21048.exe
2124	Unicorn-19056.exe
2472	Unicorn-5180.exe
2648	Unicorn-38521.exe
912	Unicorn-7894.exe
900	Unicorn-46524.exe
1004	Unicorn-7702.exe
2208	Unicorn-62933.exe
888	Unicorn-1480.exe
1820	Unicorn-1215.exe
632	Unicorn-55320.exe
1624	Unicorn-43643.exe
2036	Unicorn-57287.exe
3048	Unicorn-473.exe
1040	Unicorn-60364.exe
3068	Unicorn-14208.exe
2332	Unicorn-14692.exe
2828	Unicorn-27137.exe
2928	Unicorn-16922.exe
1132	Unicorn-14692.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2224	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	30
PID 1688 wrote to memory of 2224	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	30
PID 1688 wrote to memory of 2224	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	30
PID 1688 wrote to memory of 2224	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	30
PID 2224 wrote to memory of 2220	2224	Unicorn-38307.exe	31
PID 2224 wrote to memory of 2220	2224	Unicorn-38307.exe	31
PID 2224 wrote to memory of 2220	2224	Unicorn-38307.exe	31
PID 2224 wrote to memory of 2220	2224	Unicorn-38307.exe	31
PID 1688 wrote to memory of 2008	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	32
PID 1688 wrote to memory of 2008	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	32
PID 1688 wrote to memory of 2008	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	32
PID 1688 wrote to memory of 2008	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	32
PID 2008 wrote to memory of 2816	2008	Unicorn-57995.exe	33
PID 2008 wrote to memory of 2816	2008	Unicorn-57995.exe	33
PID 2008 wrote to memory of 2816	2008	Unicorn-57995.exe	33
PID 2008 wrote to memory of 2816	2008	Unicorn-57995.exe	33
PID 2220 wrote to memory of 2152	2220	Unicorn-22630.exe	34
PID 2220 wrote to memory of 2152	2220	Unicorn-22630.exe	34
PID 2220 wrote to memory of 2152	2220	Unicorn-22630.exe	34
PID 2220 wrote to memory of 2152	2220	Unicorn-22630.exe	34
PID 1688 wrote to memory of 2876	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	35
PID 1688 wrote to memory of 2876	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	35
PID 1688 wrote to memory of 2876	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	35
PID 1688 wrote to memory of 2876	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	35
PID 2224 wrote to memory of 2840	2224	Unicorn-38307.exe	36
PID 2224 wrote to memory of 2840	2224	Unicorn-38307.exe	36
PID 2224 wrote to memory of 2840	2224	Unicorn-38307.exe	36
PID 2224 wrote to memory of 2840	2224	Unicorn-38307.exe	36
PID 2152 wrote to memory of 264	2152	Unicorn-38857.exe	37
PID 2152 wrote to memory of 264	2152	Unicorn-38857.exe	37
PID 2152 wrote to memory of 264	2152	Unicorn-38857.exe	37
PID 2152 wrote to memory of 264	2152	Unicorn-38857.exe	37
PID 2220 wrote to memory of 1192	2220	Unicorn-22630.exe	38
PID 2220 wrote to memory of 1192	2220	Unicorn-22630.exe	38
PID 2220 wrote to memory of 1192	2220	Unicorn-22630.exe	38
PID 2220 wrote to memory of 1192	2220	Unicorn-22630.exe	38
PID 2840 wrote to memory of 3056	2840	Unicorn-29681.exe	39
PID 2840 wrote to memory of 3056	2840	Unicorn-29681.exe	39
PID 2840 wrote to memory of 3056	2840	Unicorn-29681.exe	39
PID 2840 wrote to memory of 3056	2840	Unicorn-29681.exe	39
PID 2224 wrote to memory of 2664	2224	Unicorn-38307.exe	40
PID 2224 wrote to memory of 2664	2224	Unicorn-38307.exe	40
PID 2224 wrote to memory of 2664	2224	Unicorn-38307.exe	40
PID 2224 wrote to memory of 2664	2224	Unicorn-38307.exe	40
PID 2008 wrote to memory of 2120	2008	Unicorn-57995.exe	43
PID 2008 wrote to memory of 2120	2008	Unicorn-57995.exe	43
PID 2008 wrote to memory of 2120	2008	Unicorn-57995.exe	43
PID 2008 wrote to memory of 2120	2008	Unicorn-57995.exe	43
PID 2876 wrote to memory of 980	2876	Unicorn-19104.exe	42
PID 2876 wrote to memory of 980	2876	Unicorn-19104.exe	42
PID 2876 wrote to memory of 980	2876	Unicorn-19104.exe	42
PID 2876 wrote to memory of 980	2876	Unicorn-19104.exe	42
PID 1688 wrote to memory of 1340	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	44
PID 1688 wrote to memory of 1340	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	44
PID 1688 wrote to memory of 1340	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	44
PID 1688 wrote to memory of 1340	1688	27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe	44
PID 2816 wrote to memory of 1496	2816	Unicorn-4046.exe	41
PID 2816 wrote to memory of 1496	2816	Unicorn-4046.exe	41
PID 2816 wrote to memory of 1496	2816	Unicorn-4046.exe	41
PID 2816 wrote to memory of 1496	2816	Unicorn-4046.exe	41
PID 264 wrote to memory of 1424	264	Unicorn-42531.exe	45
PID 264 wrote to memory of 1424	264	Unicorn-42531.exe	45
PID 264 wrote to memory of 1424	264	Unicorn-42531.exe	45
PID 264 wrote to memory of 1424	264	Unicorn-42531.exe	45

C:\Users\Admin\AppData\Local\Temp\27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe
"C:\Users\Admin\AppData\Local\Temp\27ffb292155fad8e70c86a28bba10b8b8a01a5aea75020ae154ee10798279851.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59586.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
        8⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        8⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe
        8⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        7⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34836.exe
        7⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        7⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49874.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        7⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
        6⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
        6⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        8⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28715.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        8⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58460.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        6⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60573.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62933.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12320.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37631.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        7⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44707.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
        6⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        7⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        6⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        7⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        7⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 188
        8⤵
        Program crash
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17920.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        6⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39139.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        7⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28715.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        5⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
        6⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
        6⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
        7⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24378.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        5⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20232.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64410.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
        7⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe
        6⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65172.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3024.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        5⤵
        
        PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        5⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55622.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44707.exe
        5⤵
        
        PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42903.exe
      4⤵
      PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        6⤵
        Executes dropped EXE
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21385.exe
        5⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46888.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
        5⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        5⤵
        
        PID:5108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 188
        6⤵
        Program crash
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26609.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47449.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        6⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52119.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        5⤵
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49713.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
        5⤵
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      4⤵
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
      4⤵
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
      4⤵
      PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
      4⤵
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30078.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
      4⤵
      PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
    3⤵
    PID:5888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57995.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
        7⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        5⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exe
      4⤵
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58460.exe
        5⤵
        
        PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14826.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
      4⤵
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28182.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
      4⤵
      PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
      4⤵
      PID:520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55419.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
      4⤵
      PID:5252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
      4⤵
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
        5⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
      4⤵
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20691.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
      4⤵
      PID:5860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9829.exe
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18521.exe
    3⤵
    PID:5148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7702.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10743.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64541.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
      4⤵
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
      4⤵
      PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60115.exe
    3⤵
    PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22847.exe
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
    3⤵
    PID:5544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
      4⤵
      PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
    3⤵
    PID:536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
    3⤵
    PID:5952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28180.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
      4⤵
      PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
      4⤵
      PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
    3⤵
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
    3⤵
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13209.exe
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
    3⤵
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
    3⤵
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63712.exe
      4⤵
      PID:4480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
    3⤵
    PID:3808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
    3⤵
    PID:5852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
  2⤵
  PID:928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
  2⤵
  PID:608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
  2⤵
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40845.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40845.exe
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
  2⤵
  PID:5896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe

Filesize
468KB

MD5
b3500ab725d2c4d4b14ab29db8b5ba19

SHA1
5622abc6ff7804b4812e8adc687cf09201723636

SHA256
a6d0658015dde1f980bcb05e8c6531144b0962ba753c64e09f3b463c88f77446

SHA512
67074a87cddf889e39aa31fa1097618b462875d2c8a5e0ab4d329402c5f69bfbd0203af2ea5fe76aee4dd2fc12169a61d2dbab087e700dba6c06e4f64556a65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe

Filesize
468KB

MD5
0520ed18c0c6c83f4838e6bbdfc63134

SHA1
bdac34724263dd90ae84d0dc4600fdacd0a01d21

SHA256
9f419958793f7c0e40ac212d046261ee6a594b58bba7333d5d6d72fe7d60069b

SHA512
cc5f4b36628459a9c3c18e694a0c0cc21fe980700a56e74755d823437e5c84973758f87c871a88e1eae712826e6f90de7b65219365eabec1be9b9db1290789c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe

Filesize
468KB

MD5
59a3d4a388901519754428862706d1c7

SHA1
4eb843b35151591f096172532b9d00677a70c323

SHA256
b4514d7dc273017e446cb0324d2eb67d88d11cdc1eb0bf1fa469ed6e24f8d0e1

SHA512
801a95d90485f173ddd8911b42f674f18cbb77693f44ef1f64cda1572f55febadeca6d8fef2cfb67de81ba85aa25cbbf0c29d6a0e18e0910a57c4b8771eb21af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe

Filesize
468KB

MD5
37628c9676f35ed66d89df2af8a2ac16

SHA1
d39d84d9b14b43a8c47c7695c429eaeb9cd35448

SHA256
0f4031aa435a91615f108dceccc276b56dc20441cd973c653a56689b1bede5b4

SHA512
44864693d7260b629c9ea5e8462ef0315d2e2f60be798b4bef23bea9cd0cd5714bc73ea3d31e57cba498d49e580d0a168d1b10578259bfcbdcb7dde3250e7121

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe

Filesize
468KB

MD5
ff5f23c1dcb7d1b379a0993546d922c3

SHA1
42f2b5871691594ab7c21826344f44f6a1032468

SHA256
578710dda685c29ca8116ef95358d3bb0c62d98d59f5489e7466a3eb58b91e92

SHA512
ab3ef55f0f4be244de108a32942fdd3ff6a2351cff6dd9c70abd5f0c29571a19ec9221522728f3af603c336eb46ce2a4267695f349ade8c01ebdadaa584307d9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe

Filesize
468KB

MD5
56b3062a0d33fae0c0e4b321c39f5070

SHA1
84db9bb4afca94de2734be4bd4ab20143f274068

SHA256
40f0684354d91b1505581fa8f736bb9758291395d0975344f2bfade2b4a43a3c

SHA512
e27fa05136d217949174f264741aae9d6b16f0395284ef832641ecbf31b22959b9abbf0e9eb6773f6743ca434ea2c4dec418a15492b90df1e7c4ce4ca544de6a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe

Filesize
468KB

MD5
2c67eccd13ebbe5703c80beae4cc9a0a

SHA1
10996f0108f30e6c6fb6e215f21b19ae0405ffb8

SHA256
01d056fe470636edf04f755f4a03098f569188ae84c601541436b8f3fed2796a

SHA512
f3086bff4798f851c74d68956e98a5be7c0bab80e19d74a4f1fba0435b50324f931e81110a318ce075d48f607ee874a537883458bd1f86b5782f9d1555dc5cec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37631.exe

Filesize
468KB

MD5
64eaa08ac4ad450836ac31fece671a65

SHA1
00d25f08d2c17590ec218c127b7f034410a0d493

SHA256
fa6fbec8ac38f0e25fdab84fabcf399285a34d582832c8fe48033db32311b919

SHA512
6e6ebeff7412da955e3204cf219b79465d90a9747f4ebe90d448db9aae09c944a2c5e488692014f9e1e950f37a8d71e754ffdca34d4d26d6c7597769f1dd7d3c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

Filesize
468KB

MD5
b81b3ff151e962da1f5e0585686ad823

SHA1
9b3fe30ea6c384e533c1f60e5584bc803b0422b3

SHA256
107a31df32ed6f463f7c72ffe21cc727e9d54edc8c276ce5d5cdd32a872b6a83

SHA512
e7a4e319d7f8c11612e865be68da5e727d5a8a5ff4accdfd61b09a5f28601972b20ab498d7a5c2f5f5d959785e744f7a08dfc5d4b61eea1e929ecb2a52543cf4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe

Filesize
468KB

MD5
25f7dcb026ee565c7ccc1e08e67c96c7

SHA1
b1f3e386ec21ed0f8dbba51cbd7c96c360c332ae

SHA256
c2b8364902e78c296c2c66443965f7d44e8f0ee1dc66068e57128d20c6a29d85

SHA512
4bec678e72306fcfdcd69a37d97c8cae9b338a4c989f64ecc53d91c9aeef8bb6c5669ae6faad6b8d4941d21bcad8a43d90327d37e3f7cd037b98d19486798a6a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe

Filesize
468KB

MD5
bde7a855f2cb57790486f35cdd811f9d

SHA1
9c1615ef03aedf2a49551aea1385dc078ee51e74

SHA256
5b502c3bcadac07e9764406552bedac56adb2ce31d590ad1e5ac7eca5e465ae3

SHA512
389edf6cf8687a43fedc77879c3328e24944b430e9c09bda9204f62ae24688407ef38f3b89d9427cc816c6df52e61ac3b2f55f8ce32eda152b0574a4a343d3e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe

Filesize
468KB

MD5
e0023dc38f26b72c2964fe71524edf50

SHA1
6e11efa531f737f846a7a7f23e66b37561803929

SHA256
8419f44b907ee517b61553e5899b7e813bb13a1d17e0e5ade21c676643933ac5

SHA512
a665352fbd7bd320765b87f2a0f81830731ace9fc2df0314af7b0005490846685b855b605a4c3de7c590d6ff537067478952f4b2cf9b51b996578b294c7f6ff5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe

Filesize
468KB

MD5
d01721491d174fd325655071fa65938b

SHA1
38d32cf4214f4e6a224d9a6727a2d2a183fa7c10

SHA256
f06a75713d4b49840a71a1db54c39c06483d65d522bbbe9e96730e55ed957c25

SHA512
f9132b8570d4dbc7761cddcfdefef25e114b879baf4fc4354505017d8cd84eb19c141019b3b2475b8b98d6871979f90cb4c4f603ecb74377427df72086d184fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

Filesize
468KB

MD5
b0739c26677a6c1851d59dc0b055ab9d

SHA1
9e32ae4c846510b67b6f65a9130dcb05cace35a0

SHA256
8165c53d2890e5810894b22373b56938be0b2857c1ce732db86dcae00f7eba60

SHA512
8b46801bfafd7868d7b6e4700ad1c752731323f242c132eb6f6dc1e243d99bccea1ca4f779db2237e42f6702eb96eae18f78a4552c0cca5c5b8cac4ac2e0d360

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57995.exe

Filesize
468KB

MD5
ef3141e374432d1c001c3b3925e33d76

SHA1
6c13140ffc51718d93cd1f4ff8bc4214958ce69f

SHA256
7d340b0ee7c17126d198da4ff899b8ab0fe4e90c0fac6feebeb1a40fc68d1346

SHA512
818d5f0630a99c9a7e7f6d0285e2f8f867808ee6f828ec9ef80b517fd3e51215658823462d030925a59a5e9b8e50b20965baf1d75f64a1121a900b6fcb12a8df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe

Filesize
468KB

MD5
877983f40480bd2ce9118d2e1c8f21c1

SHA1
8cd84d96af088d1c8da708a9825a128fea365273

SHA256
466bc210dccb6804da0b1467630898282f01f3ea70fd824537b92c8d34a2718b

SHA512
d5d912a85625641aff37c2f36db1d24e09910cd5353540b8e5a8336d2a8ab4f577aa227258059fee63b1d1df19101c26d2b6aca366335e654f17f11c06c051a0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe

Filesize
468KB

MD5
872d790f8dd6a7b9c1e961a0439cf492

SHA1
58fdc3cb932064b488b9d3d9c874f82a0f4f7c8f

SHA256
a9ce5aec385888f9b98477f520ba3e1bfd9678353937adaa0c264cc29dffc0c4

SHA512
6bc15f519c17a4afb716a3452d13f3784516586150e545fa4c47dcfd53adfc27c6b41bd1b935e435d114a8dbacd0f24b24fd581f47bd95944fc5123378dc8171

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59586.exe

Filesize
468KB

MD5
bc3f1b466c204f97db8aafaf88c08374

SHA1
164115f21527da3a20762e9e76b1a79ad8e30084

SHA256
7c62b5a51ea5fac9b89221186aebaea81031c89bca69f26d21df980c23338b6d

SHA512
7ec8b500c5bc8b1f3622ca252a519f6e14587cd828f2d0fa0c1bdcb5e206749c73e9e43d5062b00041adf2351b01bcf3de0d619fdea370ed62e4feeb83e448ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe

Filesize
468KB

MD5
fd1ef8ee15bce8510ebd04925a1f4f39

SHA1
9e5a2b8fb808265a3c353185f8065e305ce2a569

SHA256
688971a59043ce84d68eea5130c23ab3399a97f9b15c88e2644221f43e30cca0

SHA512
fd38e3a5906f33b0e19a8fcd594755adabe3f794721c8596da4a4f0592b6fd82291cc1e0f44a6e0c42e931d23241c435218ce21688dcff6dd0d16a9fe8db75bf

Download Submit
memory/264-347-0x0000000002190000-0x0000000002205000-memory.dmp

Filesize
468KB

Download
memory/264-190-0x0000000002190000-0x0000000002205000-memory.dmp

Filesize
468KB

Download
memory/264-195-0x0000000002190000-0x0000000002205000-memory.dmp

Filesize
468KB

Download
memory/264-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/264-367-0x0000000002190000-0x0000000002205000-memory.dmp

Filesize
468KB

Download
memory/820-349-0x0000000003390000-0x0000000003405000-memory.dmp

Filesize
468KB

Download
memory/980-290-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/980-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-281-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1192-230-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1192-220-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1192-381-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1192-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-252-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/1340-254-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/1340-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-337-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/1424-341-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/1496-271-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/1496-273-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/1496-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-261-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1688-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-162-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1688-306-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1688-265-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1688-157-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1688-6-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1688-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-307-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1876-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-318-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2008-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-147-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2008-142-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2120-285-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2120-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-280-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2152-92-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2152-321-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2152-325-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2152-208-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2152-207-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2152-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-25-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-231-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2220-352-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2220-366-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2220-229-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2220-351-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2224-125-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2224-23-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2224-241-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2224-246-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2224-127-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2224-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-227-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2664-221-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2700-343-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2700-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-336-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2776-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-136-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2816-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-293-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2816-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-292-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2816-169-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2840-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-333-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2876-297-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2876-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-152-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2876-303-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2876-139-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2896-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-340-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download