9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7

Analysis

max time kernel
120s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
Size

468KB
MD5

eca01e6821d2aa3371efd0551ad5d525
SHA1

4890d7b2372d147d9115fd2d6fbbbcda4e95abb7
SHA256

9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7
SHA512

4df7060e2eb3a575082645c121efd24f35b1a2c3c62cca83d159ef002302d9e3160130e235e6cadd33cbf1a83d12de6cd15496d769dbcaaaf66a5975756db698
SSDEEP

3072:8Fr8ogKxjEXj2bYfP03gqf8SlCZjXmpkPmHx1/Hw3lm72FlhU+lbe:8F4oN6j2cPCgqf8mJC3lUalhUr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2160	Unicorn-64133.exe
2864	Unicorn-2011.exe
2736	Unicorn-14818.exe
2060	Unicorn-1570.exe
2612	Unicorn-37449.exe
2296	Unicorn-57900.exe
376	Unicorn-64030.exe
2220	Unicorn-31685.exe
2504	Unicorn-63589.exe
2852	Unicorn-43723.exe
1928	Unicorn-25829.exe
2704	Unicorn-11518.exe
1252	Unicorn-31119.exe
1900	Unicorn-31384.exe
1768	Unicorn-51628.exe
2248	Unicorn-31570.exe
600	Unicorn-4731.exe
2476	Unicorn-49251.exe
956	Unicorn-37871.exe
1764	Unicorn-31740.exe
1652	Unicorn-30097.exe
984	Unicorn-13449.exe
976	Unicorn-55067.exe
1124	Unicorn-61197.exe
2300	Unicorn-61197.exe
2548	Unicorn-18253.exe
2096	Unicorn-9322.exe
872	Unicorn-63924.exe
2292	Unicorn-63732.exe
2992	Unicorn-37443.exe
2720	Unicorn-63317.exe
2828	Unicorn-49550.exe
2604	Unicorn-63976.exe
1956	Unicorn-16302.exe
1836	Unicorn-17537.exe
2640	Unicorn-11406.exe
2896	Unicorn-14666.exe
2368	Unicorn-48066.exe
2952	Unicorn-14925.exe
2908	Unicorn-40391.exe
2672	Unicorn-40391.exe
2928	Unicorn-63442.exe
2968	Unicorn-59913.exe
1148	Unicorn-26066.exe
2456	Unicorn-13208.exe
2176	Unicorn-49410.exe
1760	Unicorn-31429.exe
2496	Unicorn-64101.exe
1396	Unicorn-14059.exe
2688	Unicorn-25957.exe
2868	Unicorn-12907.exe
804	Unicorn-18056.exe
2208	Unicorn-62841.exe
2556	Unicorn-39592.exe
2760	Unicorn-21611.exe
2636	Unicorn-47277.exe
2892	Unicorn-47542.exe
2180	Unicorn-24883.exe
2136	Unicorn-7194.exe
2940	Unicorn-42263.exe
2000	Unicorn-48128.exe
1060	Unicorn-48393.exe
2116	Unicorn-48393.exe
864	Unicorn-48393.exe

Loads dropped DLL 64 IoCs

pid	Process
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2160	Unicorn-64133.exe
2160	Unicorn-64133.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2864	Unicorn-2011.exe
2864	Unicorn-2011.exe
2160	Unicorn-64133.exe
2160	Unicorn-64133.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2736	Unicorn-14818.exe
2736	Unicorn-14818.exe
2060	Unicorn-1570.exe
2060	Unicorn-1570.exe
2864	Unicorn-2011.exe
2612	Unicorn-37449.exe
2864	Unicorn-2011.exe
2612	Unicorn-37449.exe
2160	Unicorn-64133.exe
2160	Unicorn-64133.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2736	Unicorn-14818.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2736	Unicorn-14818.exe
2296	Unicorn-57900.exe
2296	Unicorn-57900.exe
2220	Unicorn-31685.exe
2220	Unicorn-31685.exe
2060	Unicorn-1570.exe
2060	Unicorn-1570.exe
2852	Unicorn-43723.exe
2852	Unicorn-43723.exe
376	Unicorn-64030.exe
376	Unicorn-64030.exe
1928	Unicorn-25829.exe
1928	Unicorn-25829.exe
2864	Unicorn-2011.exe
2864	Unicorn-2011.exe
2160	Unicorn-64133.exe
2160	Unicorn-64133.exe
2704	Unicorn-11518.exe
2704	Unicorn-11518.exe
2736	Unicorn-14818.exe
2736	Unicorn-14818.exe
1252	Unicorn-31119.exe
1900	Unicorn-31384.exe
1252	Unicorn-31119.exe
1900	Unicorn-31384.exe
2504	Unicorn-63589.exe
2504	Unicorn-63589.exe
2296	Unicorn-57900.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2296	Unicorn-57900.exe
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2612	Unicorn-37449.exe
2612	Unicorn-37449.exe
1768	Unicorn-51628.exe
1768	Unicorn-51628.exe
2220	Unicorn-31685.exe
2220	Unicorn-31685.exe
600	Unicorn-4731.exe
600	Unicorn-4731.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3848	3324	WerFault.exe	297
3828	3084	WerFault.exe	296

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12861.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
2160	Unicorn-64133.exe
2864	Unicorn-2011.exe
2736	Unicorn-14818.exe
2060	Unicorn-1570.exe
2612	Unicorn-37449.exe
2296	Unicorn-57900.exe
376	Unicorn-64030.exe
2220	Unicorn-31685.exe
2852	Unicorn-43723.exe
1928	Unicorn-25829.exe
2504	Unicorn-63589.exe
1252	Unicorn-31119.exe
2704	Unicorn-11518.exe
1900	Unicorn-31384.exe
1768	Unicorn-51628.exe
2248	Unicorn-31570.exe
600	Unicorn-4731.exe
2476	Unicorn-49251.exe
1764	Unicorn-31740.exe
956	Unicorn-37871.exe
1652	Unicorn-30097.exe
1124	Unicorn-61197.exe
2300	Unicorn-61197.exe
2548	Unicorn-18253.exe
2096	Unicorn-9322.exe
2292	Unicorn-63732.exe
984	Unicorn-13449.exe
976	Unicorn-55067.exe
872	Unicorn-63924.exe
2992	Unicorn-37443.exe
2720	Unicorn-63317.exe
2604	Unicorn-63976.exe
1956	Unicorn-16302.exe
1836	Unicorn-17537.exe
2828	Unicorn-49550.exe
2640	Unicorn-11406.exe
2896	Unicorn-14666.exe
2908	Unicorn-40391.exe
1148	Unicorn-26066.exe
1760	Unicorn-31429.exe
2456	Unicorn-13208.exe
2176	Unicorn-49410.exe
2952	Unicorn-14925.exe
2368	Unicorn-48066.exe
2968	Unicorn-59913.exe
2672	Unicorn-40391.exe
2496	Unicorn-64101.exe
1396	Unicorn-14059.exe
2928	Unicorn-63442.exe
2688	Unicorn-25957.exe
2868	Unicorn-12907.exe
804	Unicorn-18056.exe
2208	Unicorn-62841.exe
2556	Unicorn-39592.exe
2760	Unicorn-21611.exe
2892	Unicorn-47542.exe
2636	Unicorn-47277.exe
2180	Unicorn-24883.exe
2136	Unicorn-7194.exe
2940	Unicorn-42263.exe
2000	Unicorn-48128.exe
1060	Unicorn-48393.exe
864	Unicorn-48393.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2160	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	30
PID 2788 wrote to memory of 2160	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	30
PID 2788 wrote to memory of 2160	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	30
PID 2788 wrote to memory of 2160	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	30
PID 2160 wrote to memory of 2864	2160	Unicorn-64133.exe	31
PID 2160 wrote to memory of 2864	2160	Unicorn-64133.exe	31
PID 2160 wrote to memory of 2864	2160	Unicorn-64133.exe	31
PID 2160 wrote to memory of 2864	2160	Unicorn-64133.exe	31
PID 2788 wrote to memory of 2736	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	32
PID 2788 wrote to memory of 2736	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	32
PID 2788 wrote to memory of 2736	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	32
PID 2788 wrote to memory of 2736	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	32
PID 2864 wrote to memory of 2060	2864	Unicorn-2011.exe	33
PID 2864 wrote to memory of 2060	2864	Unicorn-2011.exe	33
PID 2864 wrote to memory of 2060	2864	Unicorn-2011.exe	33
PID 2864 wrote to memory of 2060	2864	Unicorn-2011.exe	33
PID 2160 wrote to memory of 2612	2160	Unicorn-64133.exe	34
PID 2160 wrote to memory of 2612	2160	Unicorn-64133.exe	34
PID 2160 wrote to memory of 2612	2160	Unicorn-64133.exe	34
PID 2160 wrote to memory of 2612	2160	Unicorn-64133.exe	34
PID 2788 wrote to memory of 2296	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	35
PID 2788 wrote to memory of 2296	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	35
PID 2788 wrote to memory of 2296	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	35
PID 2788 wrote to memory of 2296	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	35
PID 2736 wrote to memory of 376	2736	Unicorn-14818.exe	36
PID 2736 wrote to memory of 376	2736	Unicorn-14818.exe	36
PID 2736 wrote to memory of 376	2736	Unicorn-14818.exe	36
PID 2736 wrote to memory of 376	2736	Unicorn-14818.exe	36
PID 2060 wrote to memory of 2220	2060	Unicorn-1570.exe	37
PID 2060 wrote to memory of 2220	2060	Unicorn-1570.exe	37
PID 2060 wrote to memory of 2220	2060	Unicorn-1570.exe	37
PID 2060 wrote to memory of 2220	2060	Unicorn-1570.exe	37
PID 2864 wrote to memory of 2852	2864	Unicorn-2011.exe	38
PID 2864 wrote to memory of 2852	2864	Unicorn-2011.exe	38
PID 2864 wrote to memory of 2852	2864	Unicorn-2011.exe	38
PID 2864 wrote to memory of 2852	2864	Unicorn-2011.exe	38
PID 2612 wrote to memory of 2504	2612	Unicorn-37449.exe	39
PID 2612 wrote to memory of 2504	2612	Unicorn-37449.exe	39
PID 2612 wrote to memory of 2504	2612	Unicorn-37449.exe	39
PID 2612 wrote to memory of 2504	2612	Unicorn-37449.exe	39
PID 2160 wrote to memory of 1928	2160	Unicorn-64133.exe	40
PID 2160 wrote to memory of 1928	2160	Unicorn-64133.exe	40
PID 2160 wrote to memory of 1928	2160	Unicorn-64133.exe	40
PID 2160 wrote to memory of 1928	2160	Unicorn-64133.exe	40
PID 2788 wrote to memory of 1252	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	41
PID 2788 wrote to memory of 1252	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	41
PID 2788 wrote to memory of 1252	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	41
PID 2788 wrote to memory of 1252	2788	9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe	41
PID 2736 wrote to memory of 2704	2736	Unicorn-14818.exe	42
PID 2736 wrote to memory of 2704	2736	Unicorn-14818.exe	42
PID 2736 wrote to memory of 2704	2736	Unicorn-14818.exe	42
PID 2736 wrote to memory of 2704	2736	Unicorn-14818.exe	42
PID 2296 wrote to memory of 1900	2296	Unicorn-57900.exe	43
PID 2296 wrote to memory of 1900	2296	Unicorn-57900.exe	43
PID 2296 wrote to memory of 1900	2296	Unicorn-57900.exe	43
PID 2296 wrote to memory of 1900	2296	Unicorn-57900.exe	43
PID 2220 wrote to memory of 1768	2220	Unicorn-31685.exe	44
PID 2220 wrote to memory of 1768	2220	Unicorn-31685.exe	44
PID 2220 wrote to memory of 1768	2220	Unicorn-31685.exe	44
PID 2220 wrote to memory of 1768	2220	Unicorn-31685.exe	44
PID 2060 wrote to memory of 2248	2060	Unicorn-1570.exe	45
PID 2060 wrote to memory of 2248	2060	Unicorn-1570.exe	45
PID 2060 wrote to memory of 2248	2060	Unicorn-1570.exe	45
PID 2060 wrote to memory of 2248	2060	Unicorn-1570.exe	45

C:\Users\Admin\AppData\Local\Temp\9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe
"C:\Users\Admin\AppData\Local\Temp\9e7a5738cafa52541c449f6c0d58474a8c758ddf7f56ca200596dffcea8553f7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31685.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
        9⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        9⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        9⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
        8⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        8⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        8⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65270.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        7⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
        8⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        7⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26647.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        6⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exe
        7⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        8⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44016.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47947.exe
        6⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41032.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29184.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        7⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        7⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exe
        6⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39519.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        8⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15136.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        6⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        7⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        7⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23167.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe
        6⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        6⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        5⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
      4⤵
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2856.exe
      4⤵
      PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
        8⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        8⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        8⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60688.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-391.exe
        6⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15136.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        6⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        7⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 148
        8⤵
        Program crash
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        5⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        6⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30816.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        6⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        5⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        6⤵
        
        PID:284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        5⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        5⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
      4⤵
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
      4⤵
      PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        6⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        7⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 148
        8⤵
        Program crash
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40122.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        7⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        5⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        5⤵
        Executes dropped EXE
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
      4⤵
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
      4⤵
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        5⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1107.exe
        5⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
      4⤵
      PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62586.exe
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52107.exe
      4⤵
      PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
    3⤵
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50689.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
    3⤵
    PID:5440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
        5⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
      4⤵
      PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
      4⤵
      PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        5⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46629.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37857.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        5⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4307.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47921.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
      4⤵
      PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe
    3⤵
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe
    3⤵
    PID:6064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47101.exe
        6⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        6⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3010.exe
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      4⤵
      PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31429.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53676.exe
        5⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55815.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
      4⤵
      PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25957.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exe
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11481.exe
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
    3⤵
    PID:5852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe
        6⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
      4⤵
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
    3⤵
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2987.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
      4⤵
      PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
    3⤵
    PID:6100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3204.exe
      4⤵
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        5⤵
        
        PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60490.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45181.exe
    3⤵
    PID:5392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14925.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
    3⤵
    PID:5540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
  2⤵
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
  2⤵
  PID:3820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
  2⤵
  PID:5820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe

Filesize
468KB

MD5
1604d0d43239362754f6a215a3e555fb

SHA1
d65e5a8777865ddc3c11d1614192830bbb565c1f

SHA256
8e939c1af7718dba458236b2128fe8f899e1719ab753bd9ab02aa1004aa1a2c4

SHA512
5df7b584d418233d1f82076af98146396a4220361f36ee7dae696ebe327567cfcc831c481334145b38c86d5a6cfc62f2a428a7f809add8acc08c5cd18cae6d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe

Filesize
468KB

MD5
191b7417cbb6ef78c31de7decee7b8cb

SHA1
8890bce9086584e89a511f9f562f43492a085d22

SHA256
83d08e3e470390992db847f10f38e237640059e32b8ee7713ca1eb3eecb8b333

SHA512
60318f26f5afa49c5ec6458ac29c830b5ce666f9eb16ac7fb4e80d30eff4811ba28b2cad2ab0d9758329f164d10344b03870a0575a9d8f547dc31216310278f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe

Filesize
468KB

MD5
6d7179d886b07bf5b9600be4d0f8cbb7

SHA1
d9b77a1a1ea1edb2451988d501b79d98db8666e8

SHA256
208acc90f51f74f66a2871bab40db609674cae2022dcfdf7524759f4de1280ec

SHA512
adff053e59109f892bf49eab3fa5166cde56b790d0a8be0ff25e70cabe6cbd019f554d27ce2c41ca292440d9fa97b0f6f63a47dc0113823d09572ca230ba0e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe

Filesize
468KB

MD5
e0c5335e4a7667e9f3abe1d8acdc6c38

SHA1
8bed9cb2796d48866aeba77da902e2bb4bdb962a

SHA256
73fc079619c9ac190354eb0b2eb73a0b006ccc8c051a8c7fd44e77bb048689a5

SHA512
286969538d36cbf65eb16d8ec78064c4558b99a28a38de220b04cb97988e5f692e824600c48f61ff348ec86d42a06f4a1673bf7f83b2beca1f43fbb39c63a86e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe

Filesize
468KB

MD5
f50535cad92dcbd8d66ad864b7fb00ad

SHA1
5b636a8a65f1249a952f0b56a4110b6873955ff1

SHA256
501c2638313571488e895b72b92e05e490cb09af274c5aead2ea5422bf2cfad8

SHA512
040e543c4366b7e099b5bf670188928f87d60e0e1e72e2015892a90abcba40e8abdb99f0e52f845ee091f4bbcc5f345aa09ed361661e17a092d80068323d494e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40122.exe

Filesize
468KB

MD5
7aa54b1fa42d117e093e2d8b61426624

SHA1
8d054087a27f4852f1c0a466b1fa914b3169bde0

SHA256
ef0cda06b720562b0eb4c177c177e4507a6f77ba5bc66bbd595d2314a7b7a912

SHA512
238255e6f25fa17eb514e3cafc4ae35cbab4525273d14c35d3335622dc426b6f1994b77cf388a912b4f3aca4c1a2b848b7ad47190ea8b01941fbde9fb2d71552

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe

Filesize
468KB

MD5
afa2978595b2e65d24b21a153631a774

SHA1
f1aeefbf4c46fdb5874ed054a84d99e850752d8e

SHA256
5461d274b7be7c47aed770d5accd485e63e33bf48779e320dad32e9725b8572a

SHA512
cca210e94c26ce7146224c656bc8d7e5cdeae7656dccc3223c6d21300cfbb9f415da3318b77b0cedca1c8539fe00e39e6ab272479a364bb5063170b5dc5b3094

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe

Filesize
468KB

MD5
25d7b2cc2999c7f4cba0cfe9da75fdfd

SHA1
abeabcbb464bc411704b8f0b57519f5806a38d53

SHA256
33787f871c24f1fa7361dd40257a94eb4103b703271b6c0648f9627215c55aa3

SHA512
6262cd5f4d1dbc37d0d45056b88cc6d1483e03c5bc68cef89de3adb07d07138ed3d81e06b4e3f8d568c0fc8d046413d587bb966e43cafb9c3f09bc314af383f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe

Filesize
468KB

MD5
6523758169fef56664b43f0548c61724

SHA1
80e3851caea55551d708b38874305b43cb62340f

SHA256
81a88da9c94747be407b8000be6dab4456096794a9ea3bcf97684938d6a9572f

SHA512
325f9a681e11c2c86200d737bb5abdd217e97905a941abc84532ad8cd7d3068e924d977486e5eff5c8540026c64ce4a90f842b83b57a537b4a1e450a1871332d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe

Filesize
468KB

MD5
ec9b976b508cd038d428a3ae5a36e009

SHA1
3256c29aff7318e15263393434d5156cca5af1eb

SHA256
a09d0f9425f39ce098e6b37b21def09afe51c3486711f41af7885b0a136e2f0a

SHA512
ebe8a97f3d9c0d9725d20e2d0c65e87fa6001e6def142613aea3fb14cf6c00c1936bc2d0f266385837ae5122107da40905b2741c7694d02220f1054b665d44f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe

Filesize
468KB

MD5
e26f259ba8a33bdaa644598c34078c0a

SHA1
6ebef1142a79f701013545f277c8bfb2ea730f91

SHA256
3de3a6cc476c26fb4d2ce21abdeb04feb7d8c3d272d8632903d6211fac1204e1

SHA512
bf1611219ee4396d1b2f00380554b1a6eb2d49fa15d32ac8ffc51e50c0aa01813842aaa7cf354b2ad9d2b67dc74ab32afc804c78bd46f8031d12c84b2b3ae9ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe

Filesize
468KB

MD5
c907513edebc5dc397a821bdb5fdc73b

SHA1
44111632c98d3a367e1d7dfd2bd1174a58e63dfd

SHA256
eb3a7a80fb0ca093e601ec1529f8f9ba86ea4396315e08ec4457eb47e38d5eb3

SHA512
9504f5b87d8b95c27855571d2eb8d50119163cc2615b5f48dcc9f5fb075f46f384dfba84187295c14a9e058e2bb3d5ce8610b6d3c6493936c660cb45a030ec90

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe

Filesize
468KB

MD5
9bf2d48f2e199de4c005b641f3070167

SHA1
51824ebf48003480299f53f2fd2ea3ddd6045610

SHA256
ca0987b060ed049c4136cc8b52b47a78b3f5550d1a0e51ca3742f5d12c8ced5b

SHA512
5e7b798278c6410454e292bb4c0e16fd053dc684d80ac7ebd07b8f46140f3b9a94517d373ed4f0062a9ab5dac8fe66f96ca54065426dc5150ba773da1dffe498

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31685.exe

Filesize
468KB

MD5
d780b00927e626621863c9261fd46843

SHA1
fed091fd2898435b5131e96323244568b31dc12b

SHA256
048802960ac1dbd25f294ad10e7076166287b49b7d75a0056fbc442e9e0524c5

SHA512
35290c84c03ae93195428b3394fbc0af21ba9a5a2fd02b8d8512e814f79dec756468e0568702933982aea209f435e7b425284d307ec820da50a2ec3d6cae1e0d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe

Filesize
468KB

MD5
e3e69cd8eb1b2724c70a03d1c6fffc55

SHA1
fe12c36456a0bf84c16b86585a9bf0ba5015c31e

SHA256
e542eed0ec715b69cfde74a9b9a0e593a27fd92214a07d0fe993638fdebd6275

SHA512
113fe4c09878deb0d57c73e43c2f0389852d8058b04be046c34df88d594248e65d2b18eb0145a3745444e5888cbadb0d2923fb223bb391fb91b1e87ed36d4575

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe

Filesize
468KB

MD5
63a0b7b15967b2fec55a53aaca70bcbb

SHA1
88a8042681c4599fc13a2d8fed5224cf4a3d14f2

SHA256
929fe360274168dfd20af1e00f2c4ac82ec284532926d9678fbdbcc1702885ac

SHA512
6843b651fff618614a3001320c365d824dd816e9fcaa23121fa1687bf09e991ff527ab6b5868eed374a91805a029a0f695b7fbc0ed9e74367768e5398a5c18aa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe

Filesize
468KB

MD5
cb27ebac9bcc614d710595640b010431

SHA1
d3b874d85c5668e513c9a734067ef2a5a1c68ee2

SHA256
a083d7875ed8a88f4fec1dd0ed94059787fc2502a32bba2f5372bf8f2630b1ad

SHA512
679a14a8809ccee576953ee5916ab32581ff989b82f5e48cffeb78ba6b47a87e864e1f72f66a45e75ee56e504203194cec9f2132a6096e45d57664616319edbf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe

Filesize
468KB

MD5
9265bd9c3668bfdaf4e8ab073399aa11

SHA1
1ca2de351a7f2f5e0d26edabca85a9a65bd3bf2b

SHA256
92d07cd943a1f7eaa802ca243b5e6aac8e96159ff3ecec7c62d2bb5193ab6981

SHA512
8bdfedcd3401af3943f89e9f197bb9f7c191b592ec4d1fa07e850fee0636c6abd5d8b158d10a021767096a6f2b9470e52468922ee057f135ce83ae978afde242

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe

Filesize
468KB

MD5
b5cc2e1b5c7e815dd247eb46313dc42b

SHA1
d8a124ec558c19b569971af49efb526a073760f2

SHA256
356a62ef8069b9af3b58780e305260682005c9bc93befcadaa24565ff3a7e27b

SHA512
4221061c0ad2e0a1eb97f7cfa64b9748d0b6e3c3f7f65cbac690bfe56f35189e6b8d64e00824602a1665f6d25c6d6897bc7ecb3b781d6cc94db1e6e7a2b0a4d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe

Filesize
468KB

MD5
fd4baf2c1c15f2890feb8412c859a13e

SHA1
a7e948b20b0cf0432000acd7f48122d0ffc0d0b4

SHA256
18ba66f7017eb9be4bed750bf3eedeec8c5a0c3771f130aafd095c4d59fb8710

SHA512
5d32e7b3dade5c4872411c329b21c22b8a0e29f6dd90150ee594606986397e473b1c3d3545c499d544a9b968efe1677e0312ef275197410e1e00e48dcb8fc74f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe

Filesize
468KB

MD5
36cae3d2223c9cd9bb8aa3a64d0a6af0

SHA1
0780f2bf386d869b687fe56d89217bf2f5fd6024

SHA256
2b758f845ba3ec19c4f4fa0138006694391d8b750f32946bb2f8e7ea6c5f5ac8

SHA512
49d5f5c253c3c21d426f7d9a8630d0ca0b85f539ec4236fb42514b71d99bd939e805cdd59fce13c357b46609a39ed606adb7a6f4a70b71f55369c64f0431dc29

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe

Filesize
468KB

MD5
f89d2107090f59f407bd59507e22c3b3

SHA1
cc0d927f11eb8143afbdd310c8795718df4c5f1f

SHA256
0a179200ea89eb9520a29f99406dfe76ef971e672b830830d1c7ebdf15bf2edf

SHA512
9977cd252318a0d8ee3f74078a1037acd03e04067987638ec52a0da8496b564c0b8bbdc830be5c6401b88e106f05ac49ef0fd0af8de55dc5daa778f449da4a98

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe

Filesize
468KB

MD5
9494114f83e03771f7ec309892ac704a

SHA1
4888786471e3b7a8ff6314b86735329f2c82c230

SHA256
cc870149f2275926df8880b3d514559b8beca7a0e9af325cfee1fc5ec61b098d

SHA512
3326fe572c244c88253f16fe224d302d438293076617f49f79df58dd1ca6d793e68e89b6728a3e060c15a901db4530db457525dd8f222d9fca35ef0ead56ccbb

Download Submit
memory/376-217-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/376-222-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/600-354-0x0000000001ED0000-0x0000000001F45000-memory.dmp

Filesize
468KB

Download
memory/872-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-388-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/956-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-389-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/976-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/984-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-280-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/1252-276-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/1252-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-338-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/1768-337-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/1768-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-279-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1900-277-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1900-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-233-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1928-234-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1956-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-198-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/2060-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-197-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/2060-90-0x0000000002170000-0x00000000021E5000-memory.dmp

Filesize
468KB

Download
memory/2060-392-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/2096-416-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2096-418-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2096-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-53-0x00000000004A0000-0x0000000000515000-memory.dmp

Filesize
468KB

Download
memory/2160-18-0x00000000004A0000-0x0000000000515000-memory.dmp

Filesize
468KB

Download
memory/2160-255-0x00000000004A0000-0x0000000000515000-memory.dmp

Filesize
468KB

Download
memory/2160-254-0x00000000004A0000-0x0000000000515000-memory.dmp

Filesize
468KB

Download
memory/2160-128-0x00000000004A0000-0x0000000000515000-memory.dmp

Filesize
468KB

Download
memory/2220-184-0x0000000003500000-0x0000000003575000-memory.dmp

Filesize
468KB

Download
memory/2220-348-0x00000000029D0000-0x0000000002A45000-memory.dmp

Filesize
468KB

Download
memory/2220-186-0x00000000029D0000-0x0000000002A45000-memory.dmp

Filesize
468KB

Download
memory/2220-344-0x00000000029D0000-0x0000000002A45000-memory.dmp

Filesize
468KB

Download
memory/2248-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-375-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2292-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-164-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2296-157-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2296-300-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2368-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-291-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2504-288-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2548-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-307-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2612-312-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2640-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-263-0x0000000002CA0000-0x0000000002D15000-memory.dmp

Filesize
468KB

Download
memory/2704-264-0x0000000002170000-0x00000000021E5000-memory.dmp

Filesize
468KB

Download
memory/2720-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-142-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2736-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-152-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2736-272-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2736-75-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2736-275-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2788-293-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-65-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-30-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-151-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-311-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2788-70-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-301-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-11-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-33-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-139-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2788-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-6-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2828-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-211-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2852-366-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2852-205-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2864-241-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-47-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-237-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-373-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download