ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
Size

468KB
MD5

4c74ad64dfcae7a49ba0f0059f1726e0
SHA1

5734b0d24e4f34a6b2ac8c9201518e7e58f0a75a
SHA256

ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3
SHA512

e823a61ca2290f244eb260abb1488d5efa56349dc91a62559b642687b347acefddd48345a47cddc5550356a2c7f6f2ce3d40da5b3f16b5fc069e05a8287c1b1c
SSDEEP

3072:PC+rogldjf80bbYk8zhjfNr/k/ujVIpjmDHevVFw2Q53/AH6K/lg:PC6oak0b38djfNP0bI2QBYH6K

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2536	Unicorn-18064.exe
2840	Unicorn-23361.exe
2552	Unicorn-39143.exe
3016	Unicorn-36258.exe
576	Unicorn-3585.exe
2440	Unicorn-49257.exe
2980	Unicorn-5815.exe
644	Unicorn-54021.exe
2004	Unicorn-42515.exe
1552	Unicorn-57228.exe
2772	Unicorn-1483.exe
2416	Unicorn-3943.exe
1728	Unicorn-23469.exe
2208	Unicorn-29335.exe
2164	Unicorn-29600.exe
2708	Unicorn-42091.exe
1692	Unicorn-38753.exe
1076	Unicorn-62703.exe
952	Unicorn-2957.exe
1208	Unicorn-34499.exe
1648	Unicorn-50265.exe
884	Unicorn-59195.exe
1912	Unicorn-65317.exe
3008	Unicorn-2573.exe
3044	Unicorn-2573.exe
3036	Unicorn-45089.exe
1428	Unicorn-51219.exe
2308	Unicorn-47135.exe
2196	Unicorn-27218.exe
2528	Unicorn-59854.exe
2808	Unicorn-40948.exe
2580	Unicorn-19974.exe
580	Unicorn-48754.exe
2864	Unicorn-46708.exe
1852	Unicorn-8276.exe
2380	Unicorn-61006.exe
1876	Unicorn-33879.exe
2764	Unicorn-40010.exe
2752	Unicorn-32396.exe
524	Unicorn-61177.exe
2216	Unicorn-23949.exe
2128	Unicorn-56045.exe
2268	Unicorn-36179.exe
2624	Unicorn-35625.exe
236	Unicorn-15759.exe
2740	Unicorn-10159.exe
2452	Unicorn-4990.exe
1784	Unicorn-27649.exe
956	Unicorn-18718.exe
1216	Unicorn-27649.exe
2092	Unicorn-7731.exe
1572	Unicorn-7731.exe
1652	Unicorn-1866.exe
2912	Unicorn-44945.exe
2124	Unicorn-41607.exe
3020	Unicorn-8764.exe
1396	Unicorn-17679.exe
264	Unicorn-58157.exe
1408	Unicorn-49989.exe
692	Unicorn-43859.exe
2316	Unicorn-53175.exe
1996	Unicorn-39199.exe
824	Unicorn-29040.exe
2132	Unicorn-47414.exe

Loads dropped DLL 64 IoCs

pid	Process
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2536	Unicorn-18064.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2536	Unicorn-18064.exe
2552	Unicorn-39143.exe
2552	Unicorn-39143.exe
2840	Unicorn-23361.exe
2536	Unicorn-18064.exe
2840	Unicorn-23361.exe
2536	Unicorn-18064.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
3016	Unicorn-36258.exe
3016	Unicorn-36258.exe
2552	Unicorn-39143.exe
576	Unicorn-3585.exe
2552	Unicorn-39143.exe
576	Unicorn-3585.exe
2840	Unicorn-23361.exe
2840	Unicorn-23361.exe
2440	Unicorn-49257.exe
2440	Unicorn-49257.exe
2536	Unicorn-18064.exe
2536	Unicorn-18064.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2980	Unicorn-5815.exe
2980	Unicorn-5815.exe
644	Unicorn-54021.exe
644	Unicorn-54021.exe
3016	Unicorn-36258.exe
3016	Unicorn-36258.exe
1552	Unicorn-57228.exe
1552	Unicorn-57228.exe
576	Unicorn-3585.exe
576	Unicorn-3585.exe
2208	Unicorn-29335.exe
2208	Unicorn-29335.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2416	Unicorn-3943.exe
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2416	Unicorn-3943.exe
2840	Unicorn-23361.exe
2840	Unicorn-23361.exe
2440	Unicorn-49257.exe
2980	Unicorn-5815.exe
2440	Unicorn-49257.exe
2980	Unicorn-5815.exe
2552	Unicorn-39143.exe
2552	Unicorn-39143.exe
1728	Unicorn-23469.exe
1728	Unicorn-23469.exe
2004	Unicorn-42515.exe
2004	Unicorn-42515.exe
2536	Unicorn-18064.exe
2536	Unicorn-18064.exe
2708	Unicorn-42091.exe
2708	Unicorn-42091.exe
644	Unicorn-54021.exe
644	Unicorn-54021.exe
1076	Unicorn-62703.exe
1076	Unicorn-62703.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
836	824	WerFault.exe	92
988	2628	WerFault.exe	105
7152	4860	WerFault.exe	447
7164	4688	WerFault.exe	446

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41140.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
2536	Unicorn-18064.exe
2552	Unicorn-39143.exe
2840	Unicorn-23361.exe
3016	Unicorn-36258.exe
576	Unicorn-3585.exe
2440	Unicorn-49257.exe
2980	Unicorn-5815.exe
644	Unicorn-54021.exe
1552	Unicorn-57228.exe
2004	Unicorn-42515.exe
2772	Unicorn-1483.exe
2208	Unicorn-29335.exe
2416	Unicorn-3943.exe
2164	Unicorn-29600.exe
1728	Unicorn-23469.exe
2708	Unicorn-42091.exe
1076	Unicorn-62703.exe
1692	Unicorn-38753.exe
952	Unicorn-2957.exe
1208	Unicorn-34499.exe
884	Unicorn-59195.exe
1648	Unicorn-50265.exe
3044	Unicorn-2573.exe
3036	Unicorn-45089.exe
1428	Unicorn-51219.exe
2308	Unicorn-47135.exe
3008	Unicorn-2573.exe
1912	Unicorn-65317.exe
2196	Unicorn-27218.exe
2528	Unicorn-59854.exe
2808	Unicorn-40948.exe
2580	Unicorn-19974.exe
2380	Unicorn-61006.exe
2864	Unicorn-46708.exe
580	Unicorn-48754.exe
1852	Unicorn-8276.exe
2764	Unicorn-40010.exe
2752	Unicorn-32396.exe
524	Unicorn-61177.exe
1876	Unicorn-33879.exe
2624	Unicorn-35625.exe
2128	Unicorn-56045.exe
2216	Unicorn-23949.exe
2268	Unicorn-36179.exe
2740	Unicorn-10159.exe
236	Unicorn-15759.exe
2452	Unicorn-4990.exe
956	Unicorn-18718.exe
1216	Unicorn-27649.exe
1784	Unicorn-27649.exe
1572	Unicorn-7731.exe
2092	Unicorn-7731.exe
2912	Unicorn-44945.exe
1652	Unicorn-1866.exe
2124	Unicorn-41607.exe
3020	Unicorn-8764.exe
1396	Unicorn-17679.exe
264	Unicorn-58157.exe
692	Unicorn-43859.exe
1408	Unicorn-49989.exe
1996	Unicorn-39199.exe
2316	Unicorn-53175.exe
824	Unicorn-29040.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2536	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	30
PID 2824 wrote to memory of 2536	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	30
PID 2824 wrote to memory of 2536	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	30
PID 2824 wrote to memory of 2536	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	30
PID 2824 wrote to memory of 2840	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	32
PID 2824 wrote to memory of 2840	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	32
PID 2824 wrote to memory of 2840	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	32
PID 2824 wrote to memory of 2840	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	32
PID 2536 wrote to memory of 2552	2536	Unicorn-18064.exe	31
PID 2536 wrote to memory of 2552	2536	Unicorn-18064.exe	31
PID 2536 wrote to memory of 2552	2536	Unicorn-18064.exe	31
PID 2536 wrote to memory of 2552	2536	Unicorn-18064.exe	31
PID 2552 wrote to memory of 3016	2552	Unicorn-39143.exe	33
PID 2552 wrote to memory of 3016	2552	Unicorn-39143.exe	33
PID 2552 wrote to memory of 3016	2552	Unicorn-39143.exe	33
PID 2552 wrote to memory of 3016	2552	Unicorn-39143.exe	33
PID 2840 wrote to memory of 576	2840	Unicorn-23361.exe	34
PID 2840 wrote to memory of 576	2840	Unicorn-23361.exe	34
PID 2840 wrote to memory of 576	2840	Unicorn-23361.exe	34
PID 2840 wrote to memory of 576	2840	Unicorn-23361.exe	34
PID 2536 wrote to memory of 2440	2536	Unicorn-18064.exe	35
PID 2536 wrote to memory of 2440	2536	Unicorn-18064.exe	35
PID 2536 wrote to memory of 2440	2536	Unicorn-18064.exe	35
PID 2536 wrote to memory of 2440	2536	Unicorn-18064.exe	35
PID 2824 wrote to memory of 2980	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	36
PID 2824 wrote to memory of 2980	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	36
PID 2824 wrote to memory of 2980	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	36
PID 2824 wrote to memory of 2980	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	36
PID 3016 wrote to memory of 644	3016	Unicorn-36258.exe	37
PID 3016 wrote to memory of 644	3016	Unicorn-36258.exe	37
PID 3016 wrote to memory of 644	3016	Unicorn-36258.exe	37
PID 3016 wrote to memory of 644	3016	Unicorn-36258.exe	37
PID 2552 wrote to memory of 2004	2552	Unicorn-39143.exe	38
PID 2552 wrote to memory of 2004	2552	Unicorn-39143.exe	38
PID 2552 wrote to memory of 2004	2552	Unicorn-39143.exe	38
PID 2552 wrote to memory of 2004	2552	Unicorn-39143.exe	38
PID 576 wrote to memory of 1552	576	Unicorn-3585.exe	39
PID 576 wrote to memory of 1552	576	Unicorn-3585.exe	39
PID 576 wrote to memory of 1552	576	Unicorn-3585.exe	39
PID 576 wrote to memory of 1552	576	Unicorn-3585.exe	39
PID 2840 wrote to memory of 2772	2840	Unicorn-23361.exe	40
PID 2840 wrote to memory of 2772	2840	Unicorn-23361.exe	40
PID 2840 wrote to memory of 2772	2840	Unicorn-23361.exe	40
PID 2840 wrote to memory of 2772	2840	Unicorn-23361.exe	40
PID 2440 wrote to memory of 2416	2440	Unicorn-49257.exe	41
PID 2440 wrote to memory of 2416	2440	Unicorn-49257.exe	41
PID 2440 wrote to memory of 2416	2440	Unicorn-49257.exe	41
PID 2440 wrote to memory of 2416	2440	Unicorn-49257.exe	41
PID 2536 wrote to memory of 1728	2536	Unicorn-18064.exe	42
PID 2536 wrote to memory of 1728	2536	Unicorn-18064.exe	42
PID 2536 wrote to memory of 1728	2536	Unicorn-18064.exe	42
PID 2536 wrote to memory of 1728	2536	Unicorn-18064.exe	42
PID 2824 wrote to memory of 2208	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	43
PID 2824 wrote to memory of 2208	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	43
PID 2824 wrote to memory of 2208	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	43
PID 2824 wrote to memory of 2208	2824	ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe	43
PID 2980 wrote to memory of 2164	2980	Unicorn-5815.exe	44
PID 2980 wrote to memory of 2164	2980	Unicorn-5815.exe	44
PID 2980 wrote to memory of 2164	2980	Unicorn-5815.exe	44
PID 2980 wrote to memory of 2164	2980	Unicorn-5815.exe	44
PID 644 wrote to memory of 2708	644	Unicorn-54021.exe	45
PID 644 wrote to memory of 2708	644	Unicorn-54021.exe	45
PID 644 wrote to memory of 2708	644	Unicorn-54021.exe	45
PID 644 wrote to memory of 2708	644	Unicorn-54021.exe	45

C:\Users\Admin\AppData\Local\Temp\ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe
"C:\Users\Admin\AppData\Local\Temp\ba4bb929c13028a7d56c8753523970b95e53f783d24df698b6733a004231b6c3N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36258.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        9⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        10⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        10⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        10⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        9⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        9⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        9⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        9⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        9⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        9⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        8⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        8⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        8⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1533.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58157.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        8⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe
        9⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        9⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        9⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        9⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        8⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        7⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
        8⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        7⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50655.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        6⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9003.exe
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        5⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47135.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        7⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        8⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        8⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        6⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        7⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 188
        8⤵
        Program crash
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        7⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        6⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36179.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38591.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40637.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        5⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        6⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
      4⤵
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
      4⤵
      PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49257.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        6⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        6⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        6⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        5⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        5⤵
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25514.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        6⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        5⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        5⤵
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        5⤵
        
        PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        6⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10345.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        7⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        6⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        5⤵
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        5⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
      4⤵
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        5⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 188
        7⤵
        Program crash
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
      4⤵
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
      4⤵
      PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62942.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
    3⤵
    PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        8⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        6⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        6⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        7⤵
        
        PID:5312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 236
        6⤵
        Program crash
        
        PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        5⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2957.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
        6⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
        7⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        5⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        5⤵
        
        PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14606.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32001.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        6⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        5⤵
        
        PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-570.exe
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
      4⤵
      PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1483.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18088.exe
      4⤵
      PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30707.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51546.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
    3⤵
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52812.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
    3⤵
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
    3⤵
    PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
    3⤵
    PID:6428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 240
        6⤵
        Program crash
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13502.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        6⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52440.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
      4⤵
      Executes dropped EXE
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
      4⤵
      PID:796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
      4⤵
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
    3⤵
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
    3⤵
    PID:6100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55908.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
      4⤵
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        5⤵
        
        PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
      4⤵
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33394.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
      4⤵
      PID:6704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
      4⤵
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        5⤵
        
        PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
      4⤵
      PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17751.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
    3⤵
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42831.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
      4⤵
      PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
    3⤵
    PID:620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
    3⤵
    PID:5848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
    3⤵
    PID:6736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50265.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50265.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
      4⤵
      PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
      4⤵
      PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
    3⤵
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44911.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
    3⤵
    PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
    3⤵
    PID:6464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
    3⤵
    PID:6032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
  2⤵
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
    3⤵
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
    3⤵
    PID:6980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
  2⤵
  PID:3540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25946.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25946.exe
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1605.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1605.exe
  2⤵
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
  2⤵
  PID:6108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35101.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35101.exe
  2⤵
  PID:6356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1483.exe

Filesize
468KB

MD5
45366d0bc9191dec830e6ce4cf80c446

SHA1
43dcb7c90ec86125f77723f4104626b5133681b2

SHA256
4cc4418321df49a7b1ba78bd2653081d48628afca56af2ae1597fd2f378b3d3d

SHA512
3ba995e9fc95f431728c8f66af5b8b04a58c293d032ec9d54f89413825399151e42cd665111c1a423e95732d5993b63db3bc0efbd587a7a934bcb3a08f7c9229

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe

Filesize
468KB

MD5
1314ccc6acb0323dfd11fd67e558cdf1

SHA1
a08827ce653cfe60142ef94b0abe3e9c1dbc751b

SHA256
2d0cac14e630e0f85cde04061a62d1042d89081f452203adfc764a0a7477fae3

SHA512
f31e7992e7ee86da52a09c909e5efc16fb4b99c14ae9af10c3938a821b3e591ba696b4db814dbc41db7b524f2330f991f6c9e746c7de1e7b144005ddb5b599d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe

Filesize
468KB

MD5
fb372112a9e682ddd44d6e696c8fac5d

SHA1
c7bd26b636005f491ad3bd5b01ab4c3f69444700

SHA256
e77a05d04b0ded56fd56bec180bf2a5568ed5a9e2164929a3322a9eb0b4a7771

SHA512
8ebbaf681d245f64cc757e70ec667e841b406d7175c1f40f14f4857a4d69327e2003019f42fddeaf2bf2033d81aa7bc8959761de69e520c8f797197c8e96842c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe

Filesize
468KB

MD5
f183926c8df7654593df3f1d88a1df1c

SHA1
96d139559f29b6e4815b656184604567daa946a5

SHA256
af35a0fcb4aef7bb29d6532a7659bdb753daebc03f5a0a08fa939b745f5e30e2

SHA512
3bf9ae229f857cb5021add537bd86df2268b30b8ac0fbb5bb3bece735bc6910aadb12d8fb744b10341a1d6758a47d770229a70e9a5903b39ed47c58f0aa0e39b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe

Filesize
468KB

MD5
d27d4965e943304c337f0039880fb9ca

SHA1
6b88958efa7242ecda095df2c89837c99cbeca7c

SHA256
3443791a5de6559ef9f00693e89e92f72655ec10bb45b09280cbc2022d8c2b3d

SHA512
c05f486721c06ad676d1df99516f3c21b765df61b0fbd9a0e6cb7f03c492530cd5f0cbaae2e5b5936bf4dcc08c4723f944cbd0c36a00e033ffae3d1469726890

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe

Filesize
468KB

MD5
bc87b2bed1e3d6a49707b3200d438e11

SHA1
0f84041762848319597201c212133243f2884e64

SHA256
8bd5f63e55f3170ad050f1b43c7ebdfcf9ab2617ba9e0953694153c363037a1e

SHA512
4e4240fa132a41d10cde1ee3acc5930e383608a071d8192254a8ebfc65677555757d5f7f860a2b8be1a7c7e9418c5c36eb2b5826628552a2c2be4c07f44788aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe

Filesize
468KB

MD5
4f5cec7d8dae3231a186694aba6ed224

SHA1
4a8d687d24642e65fec6bde6e756a78966eb0b69

SHA256
011b2b77753fcfe3811874d3e6acca5694227f8c7922dbd8f420281288dc98fe

SHA512
dcf855784bfa969a0ca54604de33e6d5b059cc5e087d5319fdbff6c358c4e0a51661b0a0464f2401498d11e69c35e649ef753e381a6f27ef0777734fbca20fa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe

Filesize
468KB

MD5
283085e17399213741e4f094f01ec13d

SHA1
849327450051c41331dea9210f8237b0383fb07c

SHA256
c94402e66bb56df36232f0ff2a891663ccfb51783a2c6bfe23362202603fa160

SHA512
3b1d3704b15ff3a60a3b1a78ccf045fa688f7668f53ca2e75f5094d324d669560932400c22e103cc5e8e6101c4ea2a6f85fd453f59ba21268298f3f33431d174

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe

Filesize
468KB

MD5
23b318cbbff9a00450b57ca9e4f1bfae

SHA1
3c153300ab59ffd3c558f49d0d6be0a908811282

SHA256
7bf291d746e9d7c1369aa7f358b4fd7d67873a131c56ee1961d171de18e556ab

SHA512
5e4a9b36ccb5136f9d18ec15f273fe7ea5462b18c85e44fb88dc90360c019d6623c019b4e28d9879ebfc90b79e5f449d84c0b595832a051c0699b390a8d60cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe

Filesize
468KB

MD5
a9481038f2420c27c30b7f24bb027e04

SHA1
80d512614bdd8ef53e1fa314c354292f199099c0

SHA256
1cf43ee06f30d8d5cfe71324c7b2fd7c3f1d9f866688052d8485e5cf9f4d85b5

SHA512
9c00873208c0a6a2c45524e7c70b85e2ad360a2edd191279626c0cbbc8387dedfa4671a902148c11bcac460866a37e812d41f6f75e71d8a96755414d9300b45e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe

Filesize
468KB

MD5
2d014dfcae21e0f55c5d8f7ccbccaa07

SHA1
ed01aedc2576d43a371db5814df1612f8b3e73ea

SHA256
f86a8e4bc17eed766a295aa69dd1d5225d168451fc8330f4e4b79d7962e88533

SHA512
548f6b3bf813182c0af95e9fa3dabc9ad61d1da16c210bf292255afc2dca4dcc2e10d5fb497dd2f0a217732a623a1f5b43f07ecbb0def950afc321cf5c8412a4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe

Filesize
468KB

MD5
4489a09c166e471eaf808c13e8454d80

SHA1
12b9094bcaac7aef70a578ce3ec9b72d85aab0bb

SHA256
bbc5d145e667379e675d71c41b086c990bf031ac60e86360d8533f6a3157a05a

SHA512
c8ae50bfff79dcf36167d11f8a8e3dfc8c316051965b702215555a4739f75c09aa97c724011aac0db758762aff908823fd266ba0a12f3ead86c9ff5972b9adbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2957.exe

Filesize
468KB

MD5
848807237587569f57014cda41c710fe

SHA1
d3620a05c7172b73432f8f844bf34c0efcc6ae2f

SHA256
f190e65882a1008277d2d3632be2be856a3b06c2f149f06f851e576e6f124fd8

SHA512
7cef05f48cbcbddd67c81079f20fd398ad81de72ed1f1661be50f09f3621f6760598105dd5546d2e9cbb9bf6cbc5c10a1b03ac26e500aa66727178642f14fe5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe

Filesize
468KB

MD5
b114b926ff3cddcad49cad0e75ccbf21

SHA1
18f531f3e97967b0c66af143c7356c5abf8360b6

SHA256
382ffb492dcc320a849e95ba5a21415ec3775026821e0aa25b5860053cb5069f

SHA512
1fd56eb5b0fff450301a617518f57c42555bf8ff11defcfb5a667155d06a471b6063224b2c48ea6692af49e3e4eb79d22ac90d0c645d524a497f1b408d981be9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36258.exe

Filesize
468KB

MD5
b13b4233f5c8164bbcd72595957b08c9

SHA1
e066c0aa53364b57f6905da3f520c9e45e474fad

SHA256
787cecb168781f3646402d4363abd5d83993ebe176c654ae208298e1fe261dfa

SHA512
ac916cdf29438321854bd36c336907b30ec6e9de5ace23126c4e37c669466a61c00e0714340ec4528b89ddb09465a5775d4c341be4c9c8bdb663ffc09df765a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe

Filesize
468KB

MD5
d386db9550eb2739e22d0cd12e2c1049

SHA1
43c89bc75f17b9e29220f957e8461b0cacc3926b

SHA256
1a1556ccff96b6815281db2e165841552e1b6e0f4d36669064f3b6d0c1c5cfe1

SHA512
33e09c932dc684244a381b086efe6b3d40c4066217104aaca53ef89313639b6f82576695ee2e14f2a96c138325b168686e5ece634248bd86a9f2425e4d14575c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe

Filesize
468KB

MD5
bb7b940f97d69fbdbd1aba0ce06dde50

SHA1
a7bbcab0ebdc349431285c1a35942d9ec7424806

SHA256
6429bcfc4380658e493d7f747be2514f3bbe64aef0683d5d240f37f446503df9

SHA512
9d25fa9870e046685e15b2698d52add7154143f8188f0d4fdad648be1c01641fd7321c463180b27722579b965bdc8be71b3c25b3e2791ee4dda76e052f96003c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49257.exe

Filesize
468KB

MD5
4028eaf6a2ef6cf82db15161d9bbe320

SHA1
c138778d41010cd7eda12405ce6a5269f94765bf

SHA256
c75592422132038e81babab2d30d4cae5190c75e9e1c408bd3705b9f614002bf

SHA512
93cabcc27d32d7b3d5385d7223ddd33af8ad6828e0683756a3e2d6e51e2f2921e9e0b934489c17f2b8bfc7e2a5000551f8d2a5f8250d0394f08ee865df8c30c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe

Filesize
468KB

MD5
403584b81c0876b6bdc1ed2ab07d06ce

SHA1
c87a9d349a939134d980c9f96d3d7a3fc6484cba

SHA256
b76883dddc823a165bd3f8e20b741aeeedea8d099278f4c3539e684e5d7cb1f6

SHA512
3e477891f344c98d56e9ae2f69c757fafca627f8bc5521accd42f61ece54ef169bde5c39810575bcf8f183e5cd1e2a2f8aafd457e9d9e4a388d9a724e361c85a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe

Filesize
468KB

MD5
7773be3d3a0976ee8f79cc8e44cf7662

SHA1
71dc1a30e56135d6e5c8bc9b35d87bfac952c0c2

SHA256
50be045d5780d005d6a27f66c6e76d2b857493741d93b5637bcbd943d4aabe09

SHA512
944609a98088b1a4ef3cbab3183bbf84817245dd2a02d5d26d4f3ccef38a3f3923b84e19ffac7261d2cb9bd8cbd32de1ce261d6a92d5f5aab9ae5490cd59792f

Download Submit
memory/576-233-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/576-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/576-406-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/576-237-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/580-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-198-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/644-347-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/644-349-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/884-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-387-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/952-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-393-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1076-358-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/1076-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1076-357-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/1208-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-218-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1552-224-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1552-380-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1552-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-374-0x0000000003260000-0x00000000032D5000-memory.dmp

Filesize
468KB

Download
memory/1692-369-0x0000000003260000-0x00000000032D5000-memory.dmp

Filesize
468KB

Download
memory/1692-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-300-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1728-299-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1852-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-303-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2004-307-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2004-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-248-0x0000000000B20000-0x0000000000B95000-memory.dmp

Filesize
468KB

Download
memory/2208-246-0x0000000000B20000-0x0000000000B95000-memory.dmp

Filesize
468KB

Download
memory/2208-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-266-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2416-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-257-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2440-137-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2440-280-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2440-281-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2440-139-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2440-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-318-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2536-170-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2536-165-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2536-316-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2536-35-0x0000000000700000-0x0000000000775000-memory.dmp

Filesize
468KB

Download
memory/2536-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-288-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2552-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-293-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2580-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-338-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2708-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-337-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2764-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-10-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2824-265-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2824-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-255-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2824-11-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2824-181-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2824-407-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2824-171-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/2840-275-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2840-127-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2840-136-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2840-276-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2840-72-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2840-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-183-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2980-282-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2980-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-184-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2980-278-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/3008-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-384-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/3016-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-96-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/3016-212-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/3016-211-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/3016-382-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/3036-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download