0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6

Analysis

max time kernel
115s
max time network
17s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
Size

468KB
MD5

34a62063135bf41ff42b330d055dd992
SHA1

0fa2ac55ed30b4cd2240ebcdab7c8663662af433
SHA256

0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6
SHA512

93e89aeb4aaaf218af383aa9770ef6850988129f58b35713fae11087af700136ff7b3ecabc573418fa2e7c8222697bb3c6b338013d900e50a7b86f70d3c1f929
SSDEEP

3072:himxVf2MjbpU2bY9Pz36rfc/YyPKn7cgwNmHfvdpWmtcvQqiWKolr0:hiQVtNU2+PD6rfpZB2mtiHiWKp

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2080	Unicorn-25186.exe
2884	Unicorn-40448.exe
2560	Unicorn-36918.exe
2804	Unicorn-38279.exe
2860	Unicorn-59254.exe
2984	Unicorn-31956.exe
2540	Unicorn-21751.exe
2488	Unicorn-21170.exe
1612	Unicorn-152.exe
1952	Unicorn-20594.exe
1884	Unicorn-16383.exe
1552	Unicorn-54729.exe
1244	Unicorn-35128.exe
592	Unicorn-38658.exe
1844	Unicorn-54994.exe
2208	Unicorn-26728.exe
912	Unicorn-31366.exe
2164	Unicorn-12695.exe
1560	Unicorn-29398.exe
2368	Unicorn-45150.exe
944	Unicorn-52358.exe
696	Unicorn-44190.exe
2112	Unicorn-24324.exe
2116	Unicorn-11901.exe
980	Unicorn-5771.exe
892	Unicorn-11636.exe
1644	Unicorn-4699.exe
2352	Unicorn-13629.exe
2636	Unicorn-59301.exe
2956	Unicorn-2062.exe
2928	Unicorn-45918.exe
3068	Unicorn-41196.exe
2760	Unicorn-25828.exe
2752	Unicorn-31959.exe
668	Unicorn-13354.exe
1008	Unicorn-27356.exe
2456	Unicorn-58803.exe
2144	Unicorn-39525.exe
2032	Unicorn-52035.exe
1896	Unicorn-54636.exe
1928	Unicorn-38299.exe
3044	Unicorn-42213.exe
2512	Unicorn-57433.exe
1320	Unicorn-51533.exe
2680	Unicorn-49649.exe
1312	Unicorn-2908.exe
1300	Unicorn-28482.exe
1920	Unicorn-65025.exe
2224	Unicorn-57417.exe
1400	Unicorn-17154.exe
1648	Unicorn-55555.exe
1440	Unicorn-55555.exe
2616	Unicorn-34345.exe
2944	Unicorn-10225.exe
2828	Unicorn-23960.exe
2260	Unicorn-48539.exe
2712	Unicorn-40179.exe
2872	Unicorn-48466.exe
860	Unicorn-34541.exe
1776	Unicorn-47579.exe
1072	Unicorn-56816.exe
2028	Unicorn-20509.exe
1236	Unicorn-9151.exe
356	Unicorn-9151.exe

Loads dropped DLL 64 IoCs

pid	Process
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2080	Unicorn-25186.exe
2080	Unicorn-25186.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2884	Unicorn-40448.exe
2884	Unicorn-40448.exe
2080	Unicorn-25186.exe
2080	Unicorn-25186.exe
2560	Unicorn-36918.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2560	Unicorn-36918.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2804	Unicorn-38279.exe
2804	Unicorn-38279.exe
2884	Unicorn-40448.exe
2884	Unicorn-40448.exe
2860	Unicorn-59254.exe
2860	Unicorn-59254.exe
2080	Unicorn-25186.exe
2080	Unicorn-25186.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2560	Unicorn-36918.exe
2984	Unicorn-31956.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2560	Unicorn-36918.exe
2984	Unicorn-31956.exe
2540	Unicorn-21751.exe
2540	Unicorn-21751.exe
2488	Unicorn-21170.exe
2488	Unicorn-21170.exe
2804	Unicorn-38279.exe
2804	Unicorn-38279.exe
1612	Unicorn-152.exe
1612	Unicorn-152.exe
2884	Unicorn-40448.exe
2884	Unicorn-40448.exe
592	Unicorn-38658.exe
592	Unicorn-38658.exe
1244	Unicorn-35128.exe
2984	Unicorn-31956.exe
1884	Unicorn-16383.exe
1244	Unicorn-35128.exe
2984	Unicorn-31956.exe
1884	Unicorn-16383.exe
2560	Unicorn-36918.exe
1552	Unicorn-54729.exe
2080	Unicorn-25186.exe
2560	Unicorn-36918.exe
2080	Unicorn-25186.exe
1552	Unicorn-54729.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2540	Unicorn-21751.exe
2540	Unicorn-21751.exe
1952	Unicorn-20594.exe
1952	Unicorn-20594.exe
2208	Unicorn-26728.exe
2208	Unicorn-26728.exe
2488	Unicorn-21170.exe
2488	Unicorn-21170.exe
912	Unicorn-31366.exe
912	Unicorn-31366.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2236	1680	WerFault.exe	286
3928	3940	WerFault.exe	289
2128	3340	WerFault.exe	291
4120	3932	WerFault.exe	287
4152	3936	WerFault.exe	293
4192	3504	WerFault.exe	294
4404	3508	WerFault.exe	295
4396	3112	WerFault.exe	292

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-80.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13629.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
2080	Unicorn-25186.exe
2884	Unicorn-40448.exe
2560	Unicorn-36918.exe
2804	Unicorn-38279.exe
2860	Unicorn-59254.exe
2540	Unicorn-21751.exe
2984	Unicorn-31956.exe
2488	Unicorn-21170.exe
1612	Unicorn-152.exe
1552	Unicorn-54729.exe
1952	Unicorn-20594.exe
1244	Unicorn-35128.exe
1884	Unicorn-16383.exe
592	Unicorn-38658.exe
1844	Unicorn-54994.exe
2208	Unicorn-26728.exe
912	Unicorn-31366.exe
2164	Unicorn-12695.exe
1560	Unicorn-29398.exe
2368	Unicorn-45150.exe
2112	Unicorn-24324.exe
696	Unicorn-44190.exe
892	Unicorn-11636.exe
2116	Unicorn-11901.exe
980	Unicorn-5771.exe
944	Unicorn-52358.exe
2636	Unicorn-59301.exe
2352	Unicorn-13629.exe
1644	Unicorn-4699.exe
2956	Unicorn-2062.exe
2752	Unicorn-31959.exe
3068	Unicorn-41196.exe
2928	Unicorn-45918.exe
2760	Unicorn-25828.exe
668	Unicorn-13354.exe
1008	Unicorn-27356.exe
2456	Unicorn-58803.exe
2144	Unicorn-39525.exe
2032	Unicorn-52035.exe
1896	Unicorn-54636.exe
1928	Unicorn-38299.exe
3044	Unicorn-42213.exe
2512	Unicorn-57433.exe
1320	Unicorn-51533.exe
1300	Unicorn-28482.exe
1312	Unicorn-2908.exe
2680	Unicorn-49649.exe
1920	Unicorn-65025.exe
2224	Unicorn-57417.exe
1440	Unicorn-55555.exe
1400	Unicorn-17154.exe
1648	Unicorn-55555.exe
2616	Unicorn-34345.exe
2828	Unicorn-23960.exe
2944	Unicorn-10225.exe
2260	Unicorn-48539.exe
2712	Unicorn-40179.exe
2872	Unicorn-48466.exe
860	Unicorn-34541.exe
1072	Unicorn-56816.exe
356	Unicorn-9151.exe
3052	Unicorn-9151.exe
1776	Unicorn-47579.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2080	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	30
PID 2628 wrote to memory of 2080	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	30
PID 2628 wrote to memory of 2080	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	30
PID 2628 wrote to memory of 2080	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	30
PID 2080 wrote to memory of 2884	2080	Unicorn-25186.exe	32
PID 2628 wrote to memory of 2560	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	33
PID 2080 wrote to memory of 2884	2080	Unicorn-25186.exe	32
PID 2080 wrote to memory of 2884	2080	Unicorn-25186.exe	32
PID 2628 wrote to memory of 2560	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	33
PID 2080 wrote to memory of 2884	2080	Unicorn-25186.exe	32
PID 2628 wrote to memory of 2560	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	33
PID 2628 wrote to memory of 2560	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	33
PID 2884 wrote to memory of 2804	2884	Unicorn-40448.exe	34
PID 2884 wrote to memory of 2804	2884	Unicorn-40448.exe	34
PID 2884 wrote to memory of 2804	2884	Unicorn-40448.exe	34
PID 2884 wrote to memory of 2804	2884	Unicorn-40448.exe	34
PID 2080 wrote to memory of 2860	2080	Unicorn-25186.exe	35
PID 2080 wrote to memory of 2860	2080	Unicorn-25186.exe	35
PID 2080 wrote to memory of 2860	2080	Unicorn-25186.exe	35
PID 2080 wrote to memory of 2860	2080	Unicorn-25186.exe	35
PID 2560 wrote to memory of 2540	2560	Unicorn-36918.exe	36
PID 2560 wrote to memory of 2540	2560	Unicorn-36918.exe	36
PID 2560 wrote to memory of 2540	2560	Unicorn-36918.exe	36
PID 2560 wrote to memory of 2540	2560	Unicorn-36918.exe	36
PID 2628 wrote to memory of 2984	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	37
PID 2628 wrote to memory of 2984	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	37
PID 2628 wrote to memory of 2984	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	37
PID 2628 wrote to memory of 2984	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	37
PID 2804 wrote to memory of 2488	2804	Unicorn-38279.exe	38
PID 2804 wrote to memory of 2488	2804	Unicorn-38279.exe	38
PID 2804 wrote to memory of 2488	2804	Unicorn-38279.exe	38
PID 2804 wrote to memory of 2488	2804	Unicorn-38279.exe	38
PID 2884 wrote to memory of 1612	2884	Unicorn-40448.exe	39
PID 2884 wrote to memory of 1612	2884	Unicorn-40448.exe	39
PID 2884 wrote to memory of 1612	2884	Unicorn-40448.exe	39
PID 2884 wrote to memory of 1612	2884	Unicorn-40448.exe	39
PID 2860 wrote to memory of 1952	2860	Unicorn-59254.exe	40
PID 2860 wrote to memory of 1952	2860	Unicorn-59254.exe	40
PID 2860 wrote to memory of 1952	2860	Unicorn-59254.exe	40
PID 2860 wrote to memory of 1952	2860	Unicorn-59254.exe	40
PID 2080 wrote to memory of 1884	2080	Unicorn-25186.exe	41
PID 2080 wrote to memory of 1884	2080	Unicorn-25186.exe	41
PID 2080 wrote to memory of 1884	2080	Unicorn-25186.exe	41
PID 2080 wrote to memory of 1884	2080	Unicorn-25186.exe	41
PID 2628 wrote to memory of 1552	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	42
PID 2628 wrote to memory of 1552	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	42
PID 2628 wrote to memory of 1552	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	42
PID 2628 wrote to memory of 1552	2628	0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe	42
PID 2560 wrote to memory of 1244	2560	Unicorn-36918.exe	44
PID 2560 wrote to memory of 1244	2560	Unicorn-36918.exe	44
PID 2560 wrote to memory of 1244	2560	Unicorn-36918.exe	44
PID 2560 wrote to memory of 1244	2560	Unicorn-36918.exe	44
PID 2984 wrote to memory of 592	2984	Unicorn-31956.exe	43
PID 2984 wrote to memory of 592	2984	Unicorn-31956.exe	43
PID 2984 wrote to memory of 592	2984	Unicorn-31956.exe	43
PID 2984 wrote to memory of 592	2984	Unicorn-31956.exe	43
PID 2540 wrote to memory of 1844	2540	Unicorn-21751.exe	45
PID 2540 wrote to memory of 1844	2540	Unicorn-21751.exe	45
PID 2540 wrote to memory of 1844	2540	Unicorn-21751.exe	45
PID 2540 wrote to memory of 1844	2540	Unicorn-21751.exe	45
PID 2488 wrote to memory of 2208	2488	Unicorn-21170.exe	46
PID 2488 wrote to memory of 2208	2488	Unicorn-21170.exe	46
PID 2488 wrote to memory of 2208	2488	Unicorn-21170.exe	46
PID 2488 wrote to memory of 2208	2488	Unicorn-21170.exe	46

C:\Users\Admin\AppData\Local\Temp\0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe
"C:\Users\Admin\AppData\Local\Temp\0df9576f36930b3eac0fdcaa6ace70e3426d11fdb87cb8cef19954c2dfdde6b6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        9⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7803.exe
        9⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        9⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        8⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        8⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        8⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 188
        9⤵
        Program crash
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        8⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        6⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        7⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39382.exe
        7⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29706.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        6⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        5⤵
        
        PID:284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        8⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        7⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        7⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13354.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        7⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        7⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        7⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        6⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        6⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 188
        7⤵
        Program crash
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52530.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        5⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        6⤵
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34390.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25315.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        6⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        7⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        6⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58803.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        5⤵
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19534.exe
        6⤵
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        5⤵
        
        PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
      4⤵
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
      4⤵
      PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13629.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        7⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43764.exe
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        6⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 188
        7⤵
        Program crash
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      4⤵
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36638.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        6⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47253.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        6⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4042.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        5⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
        5⤵
        
        PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        5⤵
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        5⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
      4⤵
      PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
      4⤵
      PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        5⤵
        
        PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      4⤵
      PID:3508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 188
        5⤵
        Program crash
        
        PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe
    3⤵
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
    3⤵
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
    3⤵
    PID:5548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        6⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55555.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exe
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        7⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 188
        8⤵
        Program crash
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21074.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        7⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7803.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        7⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        6⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        6⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-880.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
      4⤵
      PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
      4⤵
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
      4⤵
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exe
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43870.exe
    3⤵
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42891.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
    3⤵
    PID:5252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38658.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        5⤵
        
        PID:3940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 188
        6⤵
        Program crash
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        5⤵
        Executes dropped EXE
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        5⤵
        
        PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12406.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
      4⤵
      PID:332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24324.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
    3⤵
    - Executes dropped EXE
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
      4⤵
      PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exe
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28131.exe
    3⤵
    PID:5636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55555.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
    3⤵
    PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
    3⤵
    PID:5652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19428.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      4⤵
      PID:3504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 188
        5⤵
        Program crash
        
        PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
      4⤵
      PID:5228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
    3⤵
    PID:2068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    3⤵
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 188
      4⤵
      Program crash
      PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
    3⤵
    PID:5212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
    3⤵
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
    3⤵
    PID:5312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
  2⤵
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
  2⤵
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
  2⤵
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
  2⤵
  PID:5628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe

Filesize
468KB

MD5
3b7d5a5e58cb094d6097b0a07b76ccd4

SHA1
b9629cdc0b17c7348da5400b17a74b27b2a0ccc0

SHA256
ab2fee37ee5e49c81f9badc5d0b704f6d616d8a9d0e901d6c08134946b770be1

SHA512
09b0853069819ea0a5fd6dec283ad99e8c575c3d90f9e888129d863d26f1c886d1251b6e00a2daff7f97da183ff3916bed0957ee922ba04f5a2893f9958eeda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe

Filesize
468KB

MD5
e1153577526637e5f683d726c48056ef

SHA1
8c2179c4f946255d5f3f68d7410f5de33c21f30d

SHA256
b132fb74ae1d05ec63038bb7b7d4b2ac805cdbb12b45542ad672db9ff5eb59d2

SHA512
342a8a1e463377e7e94becb1f27c292fbc2a9eb7b084e91e249bc56845b8ad6b613e6cd2ef849983e47fcc42320cd08f5fddee31641329809a76d87df8244dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe

Filesize
468KB

MD5
7993da3293e9d5b4f7529cdaeba5e9cd

SHA1
61692f76ff959795c4e181ca54e9e22f06bc05a0

SHA256
a035b7ab1e09986d94344a5ec6c45256ef7d15442891673c4184394a39f7c85c

SHA512
1de79c4f821cb5b02360fbf376a14834d13a1d215b188756957d34638c83bad99e5d544896c6702a7924cd24c81ef4d26ffb7246cbc72876d8a56fc06b736b57

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe

Filesize
468KB

MD5
136bd444b309916b2491c53528124b40

SHA1
1419c79dac7e98e53dd1cedc74b6b1d15af1e789

SHA256
c5d97ec9011a914e66dbf3858d3875174b21753381d5763fd8ee2a57cae54cf2

SHA512
6acc55a71cf3e78ac9c90c023287e0cc50b1059878f81261f2d95ba55ae8060d17b2e840c1f4d017f98c81af94f6f594de4e368c600fd7b0db5be2e13703cfeb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-152.exe

Filesize
468KB

MD5
b75cd5f1d8eaab864d8396b256ba350d

SHA1
aa3b71a751d55c3ec59af68b2ff51af76ebb04ab

SHA256
733abc139ecbff69edb1dca251a6667427ed6f38ae22c2d52e00a702d6354714

SHA512
1b61f19eeb16679aa4583001828b2080abfda3506812e52fd009f9a10f6c485937da8a396148978cb0fbb3241fbc1e9f2055639dffc375e3a475afbc8aba9375

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe

Filesize
468KB

MD5
717504e347b785a817dbf033b4be93e9

SHA1
db45409300e6f7b52fca4af4160ea7979cbe8951

SHA256
e48168d2d6a540a8d3ec817d62facea830416dbcbd27d14a693fd6754e86d0a9

SHA512
23bc3684096f3c53ae902a7fa65b4fcd5b699be7c5f7885063013f6428288ab948b13709a123486a9a61a6612dbe117b6440b6fa45cb793073a9a10fcd14d384

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe

Filesize
468KB

MD5
0fe1e081041b5468b367bb9f3e1852eb

SHA1
0fdcb84e29ff50b7d61905c7791de6431d94d368

SHA256
b6c680ae1be088895edbbff7f60c7b70eb7adff38238f9b8bfe498f36b26dee2

SHA512
de62af46c23ab69606e0a9f67c92692c42395b10313bcc6fd7faedb5038aedabf9c2be6a76b83a1ab3c9bc180973b023c466decbec7e0cd838782964a8a8f300

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe

Filesize
468KB

MD5
54d5302ae086ac233deee4050a22ab3d

SHA1
b79ad79c9662236a730c7408d6b76e4c5916995e

SHA256
6be49a0a28651977c22d556e7d26de579f2f7b45d6164f900da50803b7dd70d7

SHA512
41ed68610253ba31d4b810ae995166cba1c02b234d3050b4320d68c438f4712246162a2fd6badcd85f99278c7d4a16e4db528afda5f67bf9d699d6edb6969be8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe

Filesize
468KB

MD5
4ac4aecd4a039724693aac8fbe285b22

SHA1
b7422d64beea3154cd55fc8700816a340a9a7285

SHA256
1f8f0e200586ea3243ddb3b36a0c744ab8990514acb12440709149925e5626be

SHA512
d2246ad239b2bb679926aac66f353d839277374849d883d2c5ca076978e1142e7253cff4607577f3b554149dccded1ac1c1e9940c82a9b9e3e9ac6482d035d8c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe

Filesize
468KB

MD5
fd272402ab1ba40398162c1f0ae742e7

SHA1
5b60055fd61c4547a91c67c97cea087abbb1fb52

SHA256
1cbf2388fb707e9557ee5bc06c89ee72138948d2680653f118b3857e4e293659

SHA512
f0b857253ffddfc3ea02a8fc0041251260e046bc75e0c6260011c4d0343168c1c093efd81670c403f94fb8482aa8d46924b37c28546e1d702e431233ccbab4e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe

Filesize
468KB

MD5
c274a757f36583744f604eba15b5e343

SHA1
185add0bc737995c31eab9360d9e9c29fbe102ae

SHA256
fba8e517b8d85a30ae94e6899b38dd721c220bbb23763d513029d6730579d9a6

SHA512
c4bb42157fecb44e5e96dec49bb863ff2898bb4e359e0b385ff5220e1a93d1ad8517247f913376dd550af8da36b2c7c208454d77073b8831aa502ff8d3686323

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe

Filesize
468KB

MD5
a0b59833c9f7c5ffda0d9f36e58c8453

SHA1
1f3975f93186115cbb7ec7541cfbd93cd152c01d

SHA256
46c698e8ee81b7a70e1801a07b9edd4322c42d361ddbfd55376db14927bcfbe5

SHA512
ee3b71c8e4f9a18ee8857374dcaccf23f19683acdaa1df3024b7d74f090fa7fe096d8351c7a2ae47ca989f4d37e82e074380f8370313835cd0428505b27d57a4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe

Filesize
468KB

MD5
a2a7ef113a44b0f0b99fa1c2b5e35660

SHA1
7600ea20be80e8a344d8228cbfe9494fed9f7bea

SHA256
29e3730a478aa92391a9a6d3fe2107d01581f6b37ffa0d70ca68dfad84f7d238

SHA512
dba983e6b1ffefab962258d36d958d1dd1100c3fafbe8394901920fcc5bbc5f465a5a74a0454931ca9cca5cdbb08b7bb25a64102c566cf43ec3ddd3ede09182f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe

Filesize
468KB

MD5
799574f7cd78abd03afeb01a4ef2d0ed

SHA1
8d7dc27d2aab7e3c601e46c535bb9e5bd438cbaf

SHA256
69d15f6f6e06e3a744aa9bc5a71e29127920c129e46445fbd724a2335fbf5dc8

SHA512
411431410960be72d0aa12bc20e0109cfd2418fc5b9f30224c6546d1df7bf8327e2d1f7b12bdd219d607f3b8ef071d062d117253f4f90ec91b773bd8ddcfc733

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe

Filesize
468KB

MD5
70b0c3062c0030033e9adfd3e153d5e9

SHA1
4ae8f57f6cbb19bef71ec8694b3f0d5161366e58

SHA256
eb46944b40ea274958c232855b55071301b97a68b4e292d18c3748b3b1fab6a8

SHA512
831a2dde8189b322dbc91449bc421487cbe8fdba088485b5f5c97235bb19313dbc5351483a1264356a44bfe59d073ce57a1ec3a2ecb08b5033cca277d2d81047

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38658.exe

Filesize
468KB

MD5
1d334959f12fefb885ad7a318950355f

SHA1
1d65055b36a461cb29df9b142cb8db07e6188967

SHA256
63496881e0e034ec00de151eef44af6d84f0ec075e400987e9c1a7f7e7ee675f

SHA512
05c93969989069a461b576d70ec0b7ec18e4ba96be8eba5c9eb3f3f937a756f7f59c67aab60e16f81909076cad61c78861cb41527442809d8232fadb5aa48518

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe

Filesize
468KB

MD5
9d8fefee757640e7cdead2c5181becc0

SHA1
54d38af28258c6cd8a6f273a2178b7b1b817ede4

SHA256
3bc7ac164815047014e89f685e5e56a6db659a047d4f98ae33803f2b3c34e6be

SHA512
6489675dd1f8b512b8b6e3e456ec273a9d1fa1b8f0c737ccf09080ea4e93940856fa36831928ad94c1c66b301e40143c1782b63565ef0d3bd7c8b16d1ff0c29f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe

Filesize
468KB

MD5
ce1a1d69eb7da55e296e1003d0d9ac52

SHA1
fd8318d586ecb345733bdd1f882fa38f5cbeddd0

SHA256
d38945ebe1c3dd002b56bfaf3d33ae6079a4c2896031a6be4a119368f5d84812

SHA512
ad1eac63064f19d6bedae8c5627678abcad676f9a462ba93ce8733b17f6cad04f22280bcc79c0dd0fe44d541e5affdd81945c4606d13f79fde67636436b57435

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe

Filesize
468KB

MD5
fefebf8c539ac0206ff994cbc684c7fb

SHA1
6310ad14b53f3a8a719154e95ffccb83d27490fe

SHA256
6a3edd0429333fe0a43c1ddd0b404076ae229854fdb49b6dd702f92b844f4f4c

SHA512
350f5991d190d2a6fe52fbc5daee47f5bbc4b36c4864e0fdc5c12a6828e1b04b9239841328b11a0817021ce0a63f2c42cd794adbc1ecef6fad6e2e3083dbd896

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe

Filesize
468KB

MD5
5736cf9b7200dad48b4fcb59291a2941

SHA1
ea19f96a94cc91de76fa4ceef71d52cea4273e00

SHA256
a5752f89795014eb694e28013ae847d78fba6d54c70b37cc6ffcf4dc100d149d

SHA512
38af9208d1434dc8a6a102234b22e34cf815aab17ed558c92df215439bb358ffbcf919078e12dce20dbbd75a586ecfeddeb6791862938a38b4192beac4732f6c

Download Submit
memory/592-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-248-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/592-247-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/668-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-370-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/944-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-270-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/1244-256-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/1244-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-284-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1552-301-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1552-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-408-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1612-225-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1612-226-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1612-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-273-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/1884-260-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/1952-331-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/1952-330-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/1952-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-68-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2080-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-24-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2080-130-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2080-417-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2080-300-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2080-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-285-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2112-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-377-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2164-384-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2208-346-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2208-345-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2208-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-423-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2456-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-359-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2488-199-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2488-360-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2488-201-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2488-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-329-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2540-176-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2540-170-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2540-328-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2540-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-299-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2560-281-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2560-165-0x00000000027D0000-0x0000000002845000-memory.dmp

Filesize
468KB

Download
memory/2560-145-0x00000000027D0000-0x0000000002845000-memory.dmp

Filesize
468KB

Download
memory/2560-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-11-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-326-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-325-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-23-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-144-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-162-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-10-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-415-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-382-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2804-207-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2804-96-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2804-213-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2804-383-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2860-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-238-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2884-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-45-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2884-237-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2928-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-146-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2984-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-272-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2984-166-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2984-258-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/3068-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download