74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
Size

468KB
MD5

ee3996a25ea2e34183a67296fe07686f
SHA1

253aba6e6fab64edfe3fccc1dd53075d09daeab0
SHA256

74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e
SHA512

55b6afd9f92b4486cbbfcf8aa01a7114f190d8c9798adb49373d8727b61bd0a926346649c689e381e4db74626751fa3bf50148556061a19b4356f7deefd9a527
SSDEEP

3072:1aP5ogMXjb8I3bYfUz54ff8jEC6j4ICggaHebVzpH+43ZM7Om2lt:1aRopYI3wU14ffUXlnH+my7Om

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2192	Unicorn-23967.exe
2764	Unicorn-44835.exe
2816	Unicorn-63620.exe
2656	Unicorn-32323.exe
2780	Unicorn-32323.exe
2964	Unicorn-63307.exe
2712	Unicorn-49572.exe
2988	Unicorn-52335.exe
2420	Unicorn-37701.exe
1028	Unicorn-38336.exe
2272	Unicorn-29644.exe
1264	Unicorn-58860.exe
2280	Unicorn-49245.exe
288	Unicorn-49510.exe
1152	Unicorn-49510.exe
2264	Unicorn-58032.exe
2372	Unicorn-47244.exe
2144	Unicorn-11316.exe
928	Unicorn-48849.exe
1532	Unicorn-12155.exe
296	Unicorn-50282.exe
1960	Unicorn-50806.exe
588	Unicorn-1958.exe
3004	Unicorn-1958.exe
2348	Unicorn-39256.exe
1988	Unicorn-64356.exe
880	Unicorn-64356.exe
2472	Unicorn-51520.exe
1556	Unicorn-54109.exe
2676	Unicorn-48309.exe
2576	Unicorn-43565.exe
2716	Unicorn-3605.exe
2708	Unicorn-23471.exe
1592	Unicorn-5140.exe
2848	Unicorn-37123.exe
612	Unicorn-59790.exe
376	Unicorn-50673.exe
984	Unicorn-2803.exe
2356	Unicorn-46432.exe
1508	Unicorn-51811.exe
1644	Unicorn-52196.exe
2228	Unicorn-36273.exe
2092	Unicorn-36273.exe
1472	Unicorn-16407.exe
2124	Unicorn-29605.exe
1308	Unicorn-44727.exe
1032	Unicorn-64056.exe
1652	Unicorn-10261.exe
2060	Unicorn-16392.exe
1756	Unicorn-16126.exe
2872	Unicorn-41913.exe
1404	Unicorn-48898.exe
2184	Unicorn-3750.exe
2756	Unicorn-60821.exe
2796	Unicorn-46595.exe
2760	Unicorn-23707.exe
1972	Unicorn-14283.exe
2784	Unicorn-34149.exe
2136	Unicorn-25715.exe
2120	Unicorn-39451.exe
1148	Unicorn-19674.exe
1344	Unicorn-13543.exe
448	Unicorn-35284.exe
1684	Unicorn-21211.exe

Loads dropped DLL 64 IoCs

pid	Process
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2192	Unicorn-23967.exe
2192	Unicorn-23967.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2816	Unicorn-63620.exe
2764	Unicorn-44835.exe
2764	Unicorn-44835.exe
2816	Unicorn-63620.exe
2192	Unicorn-23967.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2192	Unicorn-23967.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2656	Unicorn-32323.exe
2656	Unicorn-32323.exe
2780	Unicorn-32323.exe
2780	Unicorn-32323.exe
2764	Unicorn-44835.exe
2764	Unicorn-44835.exe
2816	Unicorn-63620.exe
2816	Unicorn-63620.exe
2192	Unicorn-23967.exe
2192	Unicorn-23967.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2964	Unicorn-63307.exe
2712	Unicorn-49572.exe
2964	Unicorn-63307.exe
2712	Unicorn-49572.exe
2440	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
2988	Unicorn-52335.exe
2988	Unicorn-52335.exe
2420	Unicorn-37701.exe
2420	Unicorn-37701.exe
2440	WerFault.exe
2656	Unicorn-32323.exe
2656	Unicorn-32323.exe
2780	Unicorn-32323.exe
2780	Unicorn-32323.exe
288	Unicorn-49510.exe
288	Unicorn-49510.exe
1152	Unicorn-49510.exe
1152	Unicorn-49510.exe
2280	Unicorn-49245.exe
2280	Unicorn-49245.exe
2964	Unicorn-63307.exe
2712	Unicorn-49572.exe
2712	Unicorn-49572.exe
2964	Unicorn-63307.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
1028	Unicorn-38336.exe
1264	Unicorn-58860.exe
1028	Unicorn-38336.exe
1264	Unicorn-58860.exe
2192	Unicorn-23967.exe

Program crash 30 IoCs

pid	pid_target	Process	procid_target
2440	2816	WerFault.exe	33
1292	2780	WerFault.exe	35
2944	2656	WerFault.exe	34
2840	2988	WerFault.exe	38
2036	2372	WerFault.exe	48
2460	2144	WerFault.exe	49
348	2264	WerFault.exe	47
1708	2420	WerFault.exe	39
2696	928	WerFault.exe	50
2880	2272	WerFault.exe	41
1104	2676	WerFault.exe	63
960	2576	WerFault.exe	64
1996	1592	WerFault.exe	67
2984	2708	WerFault.exe	66
2392	1472	WerFault.exe	78
780	2716	WerFault.exe	65
768	612	WerFault.exe	69
1696	2848	WerFault.exe	68
3092	2124	WerFault.exe	79
3080	1148	WerFault.exe	98
1332	1644	WerFault.exe	75
3320	2760	WerFault.exe	91
3848	2336	WerFault.exe	104
4856	1324	WerFault.exe	113
4524	896	WerFault.exe	120
6052	1776	WerFault.exe	126
5372	760	WerFault.exe	138
6096	1432	WerFault.exe	132
6008	2484	WerFault.exe	139
6028	2428	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53000.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
2192	Unicorn-23967.exe
2816	Unicorn-63620.exe
2764	Unicorn-44835.exe
2780	Unicorn-32323.exe
2656	Unicorn-32323.exe
2964	Unicorn-63307.exe
2712	Unicorn-49572.exe
2420	Unicorn-37701.exe
2988	Unicorn-52335.exe
2272	Unicorn-29644.exe
1264	Unicorn-58860.exe
1028	Unicorn-38336.exe
288	Unicorn-49510.exe
1152	Unicorn-49510.exe
2280	Unicorn-49245.exe
2264	Unicorn-58032.exe
2372	Unicorn-47244.exe
2144	Unicorn-11316.exe
928	Unicorn-48849.exe
296	Unicorn-50282.exe
1532	Unicorn-12155.exe
1960	Unicorn-50806.exe
880	Unicorn-64356.exe
1988	Unicorn-64356.exe
2472	Unicorn-51520.exe
1556	Unicorn-54109.exe
3004	Unicorn-1958.exe
2348	Unicorn-39256.exe
588	Unicorn-1958.exe
2576	Unicorn-43565.exe
2676	Unicorn-48309.exe
2708	Unicorn-23471.exe
2716	Unicorn-3605.exe
1592	Unicorn-5140.exe
2848	Unicorn-37123.exe
612	Unicorn-59790.exe
984	Unicorn-2803.exe
376	Unicorn-50673.exe
2356	Unicorn-46432.exe
1508	Unicorn-51811.exe
2228	Unicorn-36273.exe
1472	Unicorn-16407.exe
2092	Unicorn-36273.exe
1644	Unicorn-52196.exe
2124	Unicorn-29605.exe
1308	Unicorn-44727.exe
2060	Unicorn-16392.exe
2184	Unicorn-3750.exe
1032	Unicorn-64056.exe
2872	Unicorn-41913.exe
1652	Unicorn-10261.exe
1756	Unicorn-16126.exe
1404	Unicorn-48898.exe
2756	Unicorn-60821.exe
2796	Unicorn-46595.exe
2760	Unicorn-23707.exe
2120	Unicorn-39451.exe
2136	Unicorn-25715.exe
2784	Unicorn-34149.exe
1972	Unicorn-14283.exe
1344	Unicorn-13543.exe
1148	Unicorn-19674.exe
448	Unicorn-35284.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2192	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	31
PID 2828 wrote to memory of 2192	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	31
PID 2828 wrote to memory of 2192	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	31
PID 2828 wrote to memory of 2192	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	31
PID 2192 wrote to memory of 2764	2192	Unicorn-23967.exe	32
PID 2192 wrote to memory of 2764	2192	Unicorn-23967.exe	32
PID 2192 wrote to memory of 2764	2192	Unicorn-23967.exe	32
PID 2192 wrote to memory of 2764	2192	Unicorn-23967.exe	32
PID 2828 wrote to memory of 2816	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	33
PID 2828 wrote to memory of 2816	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	33
PID 2828 wrote to memory of 2816	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	33
PID 2828 wrote to memory of 2816	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	33
PID 2764 wrote to memory of 2780	2764	Unicorn-44835.exe	35
PID 2764 wrote to memory of 2780	2764	Unicorn-44835.exe	35
PID 2764 wrote to memory of 2780	2764	Unicorn-44835.exe	35
PID 2764 wrote to memory of 2780	2764	Unicorn-44835.exe	35
PID 2816 wrote to memory of 2656	2816	Unicorn-63620.exe	34
PID 2816 wrote to memory of 2656	2816	Unicorn-63620.exe	34
PID 2816 wrote to memory of 2656	2816	Unicorn-63620.exe	34
PID 2816 wrote to memory of 2656	2816	Unicorn-63620.exe	34
PID 2192 wrote to memory of 2712	2192	Unicorn-23967.exe	36
PID 2192 wrote to memory of 2712	2192	Unicorn-23967.exe	36
PID 2192 wrote to memory of 2712	2192	Unicorn-23967.exe	36
PID 2192 wrote to memory of 2712	2192	Unicorn-23967.exe	36
PID 2828 wrote to memory of 2964	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	37
PID 2828 wrote to memory of 2964	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	37
PID 2828 wrote to memory of 2964	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	37
PID 2828 wrote to memory of 2964	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	37
PID 2656 wrote to memory of 2988	2656	Unicorn-32323.exe	38
PID 2656 wrote to memory of 2988	2656	Unicorn-32323.exe	38
PID 2656 wrote to memory of 2988	2656	Unicorn-32323.exe	38
PID 2656 wrote to memory of 2988	2656	Unicorn-32323.exe	38
PID 2780 wrote to memory of 2420	2780	Unicorn-32323.exe	39
PID 2780 wrote to memory of 2420	2780	Unicorn-32323.exe	39
PID 2780 wrote to memory of 2420	2780	Unicorn-32323.exe	39
PID 2780 wrote to memory of 2420	2780	Unicorn-32323.exe	39
PID 2764 wrote to memory of 1028	2764	Unicorn-44835.exe	40
PID 2764 wrote to memory of 1028	2764	Unicorn-44835.exe	40
PID 2764 wrote to memory of 1028	2764	Unicorn-44835.exe	40
PID 2764 wrote to memory of 1028	2764	Unicorn-44835.exe	40
PID 2816 wrote to memory of 2272	2816	Unicorn-63620.exe	41
PID 2816 wrote to memory of 2272	2816	Unicorn-63620.exe	41
PID 2816 wrote to memory of 2272	2816	Unicorn-63620.exe	41
PID 2816 wrote to memory of 2272	2816	Unicorn-63620.exe	41
PID 2192 wrote to memory of 1264	2192	Unicorn-23967.exe	42
PID 2192 wrote to memory of 1264	2192	Unicorn-23967.exe	42
PID 2192 wrote to memory of 1264	2192	Unicorn-23967.exe	42
PID 2192 wrote to memory of 1264	2192	Unicorn-23967.exe	42
PID 2828 wrote to memory of 2280	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	43
PID 2828 wrote to memory of 2280	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	43
PID 2828 wrote to memory of 2280	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	43
PID 2828 wrote to memory of 2280	2828	74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe	43
PID 2964 wrote to memory of 288	2964	Unicorn-63307.exe	44
PID 2964 wrote to memory of 288	2964	Unicorn-63307.exe	44
PID 2964 wrote to memory of 288	2964	Unicorn-63307.exe	44
PID 2964 wrote to memory of 288	2964	Unicorn-63307.exe	44
PID 2712 wrote to memory of 1152	2712	Unicorn-49572.exe	45
PID 2712 wrote to memory of 1152	2712	Unicorn-49572.exe	45
PID 2712 wrote to memory of 1152	2712	Unicorn-49572.exe	45
PID 2712 wrote to memory of 1152	2712	Unicorn-49572.exe	45
PID 2816 wrote to memory of 2440	2816	Unicorn-63620.exe	46
PID 2816 wrote to memory of 2440	2816	Unicorn-63620.exe	46
PID 2816 wrote to memory of 2440	2816	Unicorn-63620.exe	46
PID 2816 wrote to memory of 2440	2816	Unicorn-63620.exe	46

C:\Users\Admin\AppData\Local\Temp\74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe
"C:\Users\Admin\AppData\Local\Temp\74271301686b70265ebfbfa87378ded875212bf56ba2228a6b1c165b9c02891e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        9⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 236
        9⤵
        Program crash
        
        PID:3320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 236
        8⤵
        Program crash
        
        PID:2984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 236
        7⤵
        Program crash
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1526.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        8⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 236
        8⤵
        Program crash
        
        PID:4856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 236
        7⤵
        Program crash
        
        PID:780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 240
        6⤵
        Program crash
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        7⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        8⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 236
        8⤵
        Program crash
        
        PID:4524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 236
        7⤵
        Program crash
        
        PID:1696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 236
        6⤵
        Program crash
        
        PID:2696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 240
        5⤵
        Program crash
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        7⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        8⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        9⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        9⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        8⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        6⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        7⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49753.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13368.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30234.exe
        6⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
        5⤵
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48353.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24552.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        6⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56186.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44161.exe
        5⤵
        
        PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        5⤵
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59802.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49572.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
        7⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        6⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        6⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        8⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8878.exe
        6⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        6⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        7⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63351.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
      4⤵
      Executes dropped EXE
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exe
        5⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64764.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
      4⤵
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        7⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        7⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
        6⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53449.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        7⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50425.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44189.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-998.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        5⤵
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
      4⤵
      PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
      4⤵
      PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19552.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
      4⤵
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
      4⤵
      PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48265.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exe
      4⤵
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
    3⤵
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
      4⤵
      PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
    3⤵
    PID:3688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
    3⤵
    PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
    3⤵
    PID:3160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        8⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43212.exe
        9⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 204
        9⤵
        Program crash
        
        PID:6028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 236
        8⤵
        Program crash
        
        PID:1332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 236
        7⤵
        Program crash
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31534.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        8⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 216
        8⤵
        Program crash
        
        PID:3848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 236
        7⤵
        Program crash
        
        PID:2392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 240
        6⤵
        Program crash
        
        PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43565.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        8⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 216
        8⤵
        Program crash
        
        PID:5372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 236
        7⤵
        Program crash
        
        PID:3092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 216
        6⤵
        Program crash
        
        PID:960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 240
        5⤵
        Program crash
        
        PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        8⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 216
        8⤵
        Program crash
        
        PID:6008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 216
        7⤵
        Program crash
        
        PID:3080
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 236
        6⤵
        Program crash
        
        PID:1996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 236
        5⤵
        Program crash
        
        PID:2460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 220
      4⤵
      Program crash
      PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29644.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        6⤵
        
        PID:5864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 236
        6⤵
        Program crash
        
        PID:6052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 236
        5⤵
        Program crash
        
        PID:768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 216
      4⤵
      Program crash
      PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12155.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        6⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19902.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52277.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe
        5⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41813.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
      4⤵
      PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3094.exe
      4⤵
      PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      4⤵
      PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        5⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29603.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        5⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      4⤵
      PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        5⤵
        
        PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8041.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      4⤵
      PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
    3⤵
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
    3⤵
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        5⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      4⤵
      PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32809.exe
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41926.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
      4⤵
      PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
    3⤵
    PID:1432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 200
      4⤵
      Program crash
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
    3⤵
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe
    3⤵
    PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
    3⤵
    PID:5600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
      4⤵
      PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
    3⤵
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
    3⤵
    PID:5888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
    3⤵
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58676.exe
    3⤵
    PID:4920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
    3⤵
    PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
    3⤵
    PID:6004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42968.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42968.exe
  2⤵
  PID:3948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
  2⤵
  PID:3904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
  2⤵
  PID:4160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
  2⤵
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
  2⤵
  PID:6168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe

Filesize
468KB

MD5
f0013ceb925a60cd75130014993904d4

SHA1
580e5d6543702b6839f2567f02609d11425310d0

SHA256
abe99e5284b5a8f445201a3dde81a9fabf6b8c3ed9e76f19487e5802e8295721

SHA512
f8cf196e1c1fe93333e08d3a3a487dda2e6a8d18a27c263d6bfc8c37063624bbefda07c9c276de24dd3ec3d8b050b5c0e87b5518ed4324de16c9e2335d4060df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe

Filesize
468KB

MD5
6d4ab37207585f50a942efad268fd0ab

SHA1
25b1518adc850926129d5ebe19c3677098eab6b8

SHA256
b6ae85a3a7e05f45d6c80176e3bad43157f0d1133a407347e5435d982bee9259

SHA512
14b9813153605cd6664c1436d94bc08cbb8cc44e06593de65572c5e9a9dba40b67b366fd7ed2458884cd0c1994daaee0cd17f5c3abb4714c7ef04b244413ed08

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29644.exe

Filesize
468KB

MD5
03d98892f2b1e805517555519cdfe628

SHA1
d59c5c32540d1e505b76a934e9a9ba740209b70e

SHA256
93a03cd03511e106dd7749a6cd169e3adfcd9ee6c99c812488c60f5670ec5d22

SHA512
af400ca025ccdb7ec2b101d154f3498ba19514aa4b6dd53923e8b805194e9764b4972c627d6af04a23f44c07555f812ec033c8e43060c20abe7ca2b3cc91d9ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe

Filesize
468KB

MD5
98ebaa95e3316511a48d25137658f48a

SHA1
7c14ae83969b5f20c2a67a2dcbd5be4585c54f28

SHA256
b23a2683919ff2ae9a7f379f5e1b4612a6f05ab4ad59b0989ed7ba95db6f95a4

SHA512
d20cb40ac8767574b3d2271e9fa33c54cc36826d280f9cd537068df48ce5816acf717b802f2919960f509562557f332d94cb6db0fce8a679b17aaf7fbbf4404a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe

Filesize
468KB

MD5
5237fd8c9ab57d289ade4ad84b2f88e7

SHA1
3fc8a0488c945632d19b4e6d7e68f845be0f9684

SHA256
54f8703ec099e56eb5c37fdb9c122941a4d219473b4073583fdcfc60979d8d03

SHA512
8f9cf8326497e89c653a5ad508aa030427736fa9efd4c974019ed787a15eadb50e70e6fdceb69d997d67198995719d04d20e322323b3054cbce1c2b5fac4fd2a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe

Filesize
468KB

MD5
ed8d62e7f6fa6a324058042d90324608

SHA1
45f4503ffbe30101b723ebaeac7df6ad66c3c191

SHA256
5e6ce84e33f27ee873aa39b374c7b22f470b4be7dd3a8e4b15e8bd6fe72b71da

SHA512
f4b94fd2fb9c33679accca3582a2b9d70a4505c37add5a5383b7c2866d69492948444168356fc4eca9a0d61c6c96678d809c1638490088acbb45ea79378d8066

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe

Filesize
468KB

MD5
41c2d463ca7d6e8cc14ecdfac1b59f59

SHA1
29e309805aba25699789039e45eb1cf0bb1d808e

SHA256
3b3cc5956aa9aaa7d6d1ccb5ee593976e4b7bd0ac9697570df7a569533c30bf2

SHA512
8ac0b1cb127e3b9dd1db9076e9744fef83921425d04308f15cb731174ca922859f7fb09da4c9379bab17420f24d6962ebfc3219c59a8b6811205c600f30c4593

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe

Filesize
468KB

MD5
acafefb532ef5c89941b4c610ec297a1

SHA1
001ea88c3c548cc6d81b65ca381a95f4bd8dfe15

SHA256
224d53a07000d5987fb55f1152fc087daabd945148ebe0827a3782fab836bbd8

SHA512
e834a87b7765d4170b6ee8200d62d3ca39f0d4d41f3f228c2bf68d879412ceb5ec5eb53cf0534c7c8df3edc8d3ad9f0a8ceedc4bff61670eac86942d41f4f66e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe

Filesize
468KB

MD5
56210fedab17d47c8115041b312cfde3

SHA1
5acd48cedf9ecc1911b23e1e73027cf16d05c189

SHA256
59ec7517faf9ba422ab3577e9a9e668815e59d9579f8a57cff49bcf845ac2026

SHA512
4a04d25e176ba2b28d35de920a0b92fc1d1bfc3ee88aa76b9eb9a872b2270a98ecc5997bbb4bbddfa49e9f00c9fbffdd2c585f3d460d03c07eeee33b72b05d33

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49572.exe

Filesize
468KB

MD5
8c844aba2ded0c6f6b2bec0d825a0388

SHA1
5c23e41cbe79f54b002e967831f63f3fb7ff5ca3

SHA256
fcc1570e54ac519ecff6f488c20e3783f871320781732a3bcc02d305c36551a7

SHA512
7f9f54a5eba57e9f24b565052475d02026813a29852ee61503638af1f4c02ce92b720606d6dd120a3382749c3ebe8434492a53bcc26252511e0bf8e0941f18c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe

Filesize
468KB

MD5
f267e28aca0785bc9bb5497dbe6c45bc

SHA1
25ef7de59bbdcef4a3476dfead216859ba262eb8

SHA256
5204bab07a0ae5146dd17ab2cdfa74e3e20a2978bc5c9bbfafc6f08f850b7893

SHA512
69d4e763154247b8a4d12f75cb90346c3c09c6af61ee626f96d5d4f3884285b753e739d14f67f94ca25ff9b1d47992f656578b23a9ca3a4bbd35af71e0c8741a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58032.exe

Filesize
468KB

MD5
431613f4ab3a950e2f999c61697e25d3

SHA1
0b68b3c5514f7ea08d8dac836f7ea03d8369eaa2

SHA256
86e4323df62dda76b4aff7b467f6d57244ffd5d437e2333bdc0c8b74d1002957

SHA512
54b6de8adc279cea97c8ccf4e458716688cb36d4ab9a79ae80355d8c7dd79eaacfcf17893497759eb91469beb4c38e51ae40a983b592959304175c251e5a06be

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe

Filesize
468KB

MD5
dbcadb7e96e9cf122590cd2318eec48e

SHA1
7898a645f48c37d85e5d09a58f7575ea3705a38a

SHA256
9a13b77a71ef1d6437d6dd0ca3b7bdb145fa99c758ff8ec5270825bf6d84046f

SHA512
885ae8b1b8177754b61ca26ac97b84802698a62efc7429a82974d5b34e186727aefa1270310f65b9151e589feff0ba493cf882b5810f6c0122de531521613b8f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe

Filesize
468KB

MD5
9f571a115ae952ddba7a862e77c3b045

SHA1
83d04e6a5866f1d16ab271cf8ac2ce6937b90efb

SHA256
a92cf3f428d209007588d6ef148c12ec857226c6dfe2960a5cb209de935cf481

SHA512
84d05fe89e6b926c34a2c0cbe48860f3cffab866b5f751a3642307e5f966ec40c6cc0613b4e2f30155bd8a037105b1b4b9e0ac95dbbd678e6a84149ed9f9a945

Download Submit
memory/288-235-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/288-237-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/376-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/588-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/612-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-358-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/928-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-357-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/984-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-271-0x0000000002190000-0x0000000002205000-memory.dmp

Filesize
468KB

Download
memory/1028-268-0x0000000002190000-0x0000000002205000-memory.dmp

Filesize
468KB

Download
memory/1028-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-239-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1152-384-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1152-240-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1264-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-272-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/1264-269-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/1532-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-348-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2144-351-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2192-22-0x00000000035C0000-0x0000000003635000-memory.dmp

Filesize
468KB

Download
memory/2192-70-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2192-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-279-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2192-362-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2192-141-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2192-350-0x00000000035C0000-0x0000000003635000-memory.dmp

Filesize
468KB

Download
memory/2192-142-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2192-275-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2192-24-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2264-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-307-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2272-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-249-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/2280-248-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/2348-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-333-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2420-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-332-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2420-198-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2420-199-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2420-331-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/2472-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-208-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/2656-87-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/2656-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-209-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/2676-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-256-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2712-257-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2712-152-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2712-157-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2712-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-110-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/2764-297-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/2764-298-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/2764-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-220-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2780-221-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2780-97-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2816-389-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2816-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-50-0x0000000003750000-0x00000000037C5000-memory.dmp

Filesize
468KB

Download
memory/2816-120-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2828-145-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2828-29-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2828-266-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2828-5-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2828-261-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2828-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-374-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2828-144-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2848-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-255-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2964-150-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2964-156-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2988-318-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/2988-317-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/2988-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-187-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/2988-189-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download