cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b

Analysis

max time kernel
150s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe
Size

468KB
MD5

2cc70a779156703ac333308dfd449783
SHA1

d2ef030b1050707bf5a6f3bfc1f135f0ecaa97f1
SHA256

cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b
SHA512

dc521af0ba9099c42e263a11a342561868f9c5dffc4a41b6d4f0c974120cd85d68ef28bfaa9aafd1467cd1a55dd6ca5597c21694202144461b14df298ed8eb83
SSDEEP

3072:ECmCogKOjZ8UFbY+Pz3yqf+/IRhm4XpTGmHxqlFmA8k5h2+N0zl4:ECro+KUFtPDyqfz5f1A8Io+N0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2776	Unicorn-63508.exe
3740	Unicorn-13923.exe
556	Unicorn-26730.exe
768	Unicorn-13254.exe
4732	Unicorn-30468.exe
1012	Unicorn-43466.exe
4432	Unicorn-24337.exe
1680	Unicorn-17796.exe
2036	Unicorn-45870.exe
4676	Unicorn-49892.exe
540	Unicorn-691.exe
4856	Unicorn-61630.exe
1984	Unicorn-10897.exe
440	Unicorn-64702.exe
3276	Unicorn-499.exe
4384	Unicorn-45751.exe
2356	Unicorn-46628.exe
3832	Unicorn-26762.exe
4664	Unicorn-23969.exe
1732	Unicorn-15190.exe
4988	Unicorn-61163.exe
3776	Unicorn-5219.exe
1876	Unicorn-12433.exe
3092	Unicorn-21364.exe
3212	Unicorn-4835.exe
3240	Unicorn-21172.exe
5028	Unicorn-17642.exe
3636	Unicorn-50315.exe
4752	Unicorn-4378.exe
4508	Unicorn-64050.exe
4404	Unicorn-30980.exe
8	Unicorn-12733.exe
4000	Unicorn-15988.exe
3668	Unicorn-15796.exe
4160	Unicorn-15530.exe
2980	Unicorn-2339.exe
4264	Unicorn-11476.exe
4772	Unicorn-63278.exe
5048	Unicorn-63278.exe
2016	Unicorn-1078.exe
2084	Unicorn-28689.exe
3764	Unicorn-63963.exe
2924	Unicorn-24919.exe
976	Unicorn-9267.exe
1700	Unicorn-25604.exe
4696	Unicorn-38602.exe
4716	Unicorn-48954.exe
3476	Unicorn-54555.exe
2020	Unicorn-25220.exe
4828	Unicorn-1492.exe
1192	Unicorn-23767.exe
4672	Unicorn-40980.exe
548	Unicorn-27524.exe
2632	Unicorn-996.exe
1944	Unicorn-27524.exe
1796	Unicorn-56667.exe
3724	Unicorn-3796.exe
1444	Unicorn-43403.exe
1496	Unicorn-40138.exe
4336	Unicorn-30596.exe
4700	Unicorn-42141.exe
3800	Unicorn-13683.exe
3340	Unicorn-40226.exe
1892	Unicorn-40989.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5684	5048	WerFault.exe	132
15148	14296	WerFault.exe	666
15132	14212	WerFault.exe	663
15180	14204	WerFault.exe	662
16244	15800	WerFault.exe	781
15952	3588	WerFault.exe	810

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16266.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
16392	Process not Found
15844	Process not Found
16456	Process not Found
840	Process not Found
852	Process not Found
784	Process not Found
3036	Process not Found
3560	Process not Found
4308	Process not Found
5136	Process not Found
5332	Process not Found
16620	Process not Found
16776	Process not Found
16728	Process not Found
4296	Process not Found
16404	Process not Found
5344	Process not Found
16988	Process not Found
5348	Process not Found
16008	Process not Found
16380	Process not Found
5452	Process not Found
5460	Process not Found
5476	Process not Found
5480	Process not Found
5520	Process not Found
5536	Process not Found
5564	Process not Found
2780	Process not Found
728	Process not Found
16704	Process not Found
4760	Process not Found
16788	Process not Found
16700	Process not Found
16852	Process not Found
400	Process not Found
16984	Process not Found
1088	Process not Found
3008	Process not Found
3152	Process not Found
1784	Process not Found
1400	Process not Found
2328	Process not Found
2096	Process not Found
1544	Process not Found
15692	Process not Found
5960	Process not Found
5876	Process not Found
5932	Process not Found
16624	Process not Found
16628	Process not Found
6036	Process not Found
6064	Process not Found
6068	Process not Found
6120	Process not Found
6124	Process not Found
15544	Process not Found
6040	Process not Found
3136	Process not Found
4116	Process not Found
6088	Process not Found
5252	Process not Found
6104	Process not Found
6112	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16048	dwm.exe
Token: SeChangeNotifyPrivilege	16048	dwm.exe
Token: 33	16048	dwm.exe
Token: SeIncBasePriorityPrivilege	16048	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe
2776	Unicorn-63508.exe
3740	Unicorn-13923.exe
556	Unicorn-26730.exe
768	Unicorn-13254.exe
1012	Unicorn-43466.exe
4732	Unicorn-30468.exe
4432	Unicorn-24337.exe
1680	Unicorn-17796.exe
2036	Unicorn-45870.exe
4676	Unicorn-49892.exe
440	Unicorn-64702.exe
4856	Unicorn-61630.exe
540	Unicorn-691.exe
3276	Unicorn-499.exe
1984	Unicorn-10897.exe
4384	Unicorn-45751.exe
2356	Unicorn-46628.exe
4664	Unicorn-23969.exe
3832	Unicorn-26762.exe
1732	Unicorn-15190.exe
4988	Unicorn-61163.exe
3776	Unicorn-5219.exe
3092	Unicorn-21364.exe
1876	Unicorn-12433.exe
4752	Unicorn-4378.exe
3240	Unicorn-21172.exe
3636	Unicorn-50315.exe
3212	Unicorn-4835.exe
4508	Unicorn-64050.exe
5028	Unicorn-17642.exe
4404	Unicorn-30980.exe
8	Unicorn-12733.exe
4000	Unicorn-15988.exe
3668	Unicorn-15796.exe
4160	Unicorn-15530.exe
2980	Unicorn-2339.exe
3764	Unicorn-63963.exe
4264	Unicorn-11476.exe
4772	Unicorn-63278.exe
5048	Unicorn-63278.exe
2016	Unicorn-1078.exe
2084	Unicorn-28689.exe
2924	Unicorn-24919.exe
976	Unicorn-9267.exe
1700	Unicorn-25604.exe
4696	Unicorn-38602.exe
4716	Unicorn-48954.exe
3476	Unicorn-54555.exe
2020	Unicorn-25220.exe
4828	Unicorn-1492.exe
1192	Unicorn-23767.exe
2632	Unicorn-996.exe
1944	Unicorn-27524.exe
4672	Unicorn-40980.exe
1796	Unicorn-56667.exe
548	Unicorn-27524.exe
3724	Unicorn-3796.exe
1496	Unicorn-40138.exe
1444	Unicorn-43403.exe
4336	Unicorn-30596.exe
3340	Unicorn-40226.exe
3800	Unicorn-13683.exe
4700	Unicorn-42141.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2776	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	87
PID 3996 wrote to memory of 2776	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	87
PID 3996 wrote to memory of 2776	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	87
PID 2776 wrote to memory of 3740	2776	Unicorn-63508.exe	92
PID 2776 wrote to memory of 3740	2776	Unicorn-63508.exe	92
PID 2776 wrote to memory of 3740	2776	Unicorn-63508.exe	92
PID 3996 wrote to memory of 556	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	93
PID 3996 wrote to memory of 556	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	93
PID 3996 wrote to memory of 556	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	93
PID 3740 wrote to memory of 768	3740	Unicorn-13923.exe	95
PID 3740 wrote to memory of 768	3740	Unicorn-13923.exe	95
PID 3740 wrote to memory of 768	3740	Unicorn-13923.exe	95
PID 556 wrote to memory of 4732	556	Unicorn-26730.exe	97
PID 556 wrote to memory of 4732	556	Unicorn-26730.exe	97
PID 556 wrote to memory of 4732	556	Unicorn-26730.exe	97
PID 2776 wrote to memory of 1012	2776	Unicorn-63508.exe	96
PID 2776 wrote to memory of 1012	2776	Unicorn-63508.exe	96
PID 2776 wrote to memory of 1012	2776	Unicorn-63508.exe	96
PID 3996 wrote to memory of 4432	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	98
PID 3996 wrote to memory of 4432	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	98
PID 3996 wrote to memory of 4432	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	98
PID 768 wrote to memory of 1680	768	Unicorn-13254.exe	101
PID 768 wrote to memory of 1680	768	Unicorn-13254.exe	101
PID 768 wrote to memory of 1680	768	Unicorn-13254.exe	101
PID 3740 wrote to memory of 2036	3740	Unicorn-13923.exe	102
PID 3740 wrote to memory of 2036	3740	Unicorn-13923.exe	102
PID 3740 wrote to memory of 2036	3740	Unicorn-13923.exe	102
PID 1012 wrote to memory of 4676	1012	Unicorn-43466.exe	103
PID 1012 wrote to memory of 4676	1012	Unicorn-43466.exe	103
PID 1012 wrote to memory of 4676	1012	Unicorn-43466.exe	103
PID 4732 wrote to memory of 540	4732	Unicorn-30468.exe	104
PID 4732 wrote to memory of 540	4732	Unicorn-30468.exe	104
PID 4732 wrote to memory of 540	4732	Unicorn-30468.exe	104
PID 556 wrote to memory of 4856	556	Unicorn-26730.exe	106
PID 556 wrote to memory of 4856	556	Unicorn-26730.exe	106
PID 556 wrote to memory of 4856	556	Unicorn-26730.exe	106
PID 2776 wrote to memory of 1984	2776	Unicorn-63508.exe	105
PID 2776 wrote to memory of 1984	2776	Unicorn-63508.exe	105
PID 2776 wrote to memory of 1984	2776	Unicorn-63508.exe	105
PID 3996 wrote to memory of 440	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	108
PID 3996 wrote to memory of 440	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	108
PID 3996 wrote to memory of 440	3996	cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe	108
PID 4432 wrote to memory of 3276	4432	Unicorn-24337.exe	107
PID 4432 wrote to memory of 3276	4432	Unicorn-24337.exe	107
PID 4432 wrote to memory of 3276	4432	Unicorn-24337.exe	107
PID 1680 wrote to memory of 4384	1680	Unicorn-17796.exe	109
PID 1680 wrote to memory of 4384	1680	Unicorn-17796.exe	109
PID 1680 wrote to memory of 4384	1680	Unicorn-17796.exe	109
PID 2036 wrote to memory of 2356	2036	Unicorn-45870.exe	111
PID 2036 wrote to memory of 2356	2036	Unicorn-45870.exe	111
PID 2036 wrote to memory of 2356	2036	Unicorn-45870.exe	111
PID 768 wrote to memory of 3832	768	Unicorn-13254.exe	110
PID 768 wrote to memory of 3832	768	Unicorn-13254.exe	110
PID 768 wrote to memory of 3832	768	Unicorn-13254.exe	110
PID 3740 wrote to memory of 4664	3740	Unicorn-13923.exe	112
PID 3740 wrote to memory of 4664	3740	Unicorn-13923.exe	112
PID 3740 wrote to memory of 4664	3740	Unicorn-13923.exe	112
PID 4676 wrote to memory of 1732	4676	Unicorn-49892.exe	113
PID 4676 wrote to memory of 1732	4676	Unicorn-49892.exe	113
PID 4676 wrote to memory of 1732	4676	Unicorn-49892.exe	113
PID 1012 wrote to memory of 4988	1012	Unicorn-43466.exe	114
PID 1012 wrote to memory of 4988	1012	Unicorn-43466.exe	114
PID 1012 wrote to memory of 4988	1012	Unicorn-43466.exe	114
PID 440 wrote to memory of 3776	440	Unicorn-64702.exe	115

C:\Users\Admin\AppData\Local\Temp\cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe
"C:\Users\Admin\AppData\Local\Temp\cdb2cf3e0e35a6939e951026c4d6234ff313834efa92be179e0da3954253449b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13923.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30980.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        9⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        10⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        11⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        10⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        10⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        9⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        10⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        9⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        8⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe
        9⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        10⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        9⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        9⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7219.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46663.exe
        9⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        10⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        10⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        10⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        9⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        9⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15309.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        9⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        8⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        8⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        9⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        9⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        8⤵
        
        PID:14204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14204 -s 464
        9⤵
        Program crash
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        8⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37386.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        7⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        9⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        9⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32384.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        9⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        9⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        9⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        9⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        9⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        8⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        8⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        9⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53813.exe
        9⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        8⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        8⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        7⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43320.exe
        6⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        6⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48100.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44658.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        8⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        8⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27038.exe
        7⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        8⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        7⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6180.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37243.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        7⤵
        
        PID:14212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14212 -s 464
        8⤵
        Program crash
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
        7⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47707.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
        6⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9549.exe
        6⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
        5⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56564.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        9⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        10⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        10⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
        9⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        8⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        9⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        9⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
        8⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        7⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        6⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        8⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26515.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        7⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
        6⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62914.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        6⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        6⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40699.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3635.exe
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        6⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        9⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        7⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        7⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        6⤵
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6665.exe
        9⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22400.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        7⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
        6⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        6⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34340.exe
        7⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        6⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        5⤵
        
        PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        8⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        7⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
        6⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
        6⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29732.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        5⤵
        
        PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
      4⤵
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32251.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
        5⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        6⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        5⤵
        
        PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        5⤵
        
        PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19837.exe
        9⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        10⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        10⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        9⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        9⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        8⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
        7⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23476.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
        7⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        7⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5048
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 692
        6⤵
        Program crash
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        5⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22989.exe
        8⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
        7⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        7⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        6⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31323.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
        6⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        9⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        9⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        7⤵
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6180.exe
        7⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        5⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25316.exe
        7⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        6⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63099.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        6⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        5⤵
        
        PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28689.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        7⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28090.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63037.exe
        6⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
        5⤵
        
        PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20346.exe
      4⤵
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        6⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        5⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        6⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
        5⤵
        
        PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
      4⤵
      PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
      4⤵
      PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        5⤵
        
        PID:13752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
      4⤵
      PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
      4⤵
      PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        6⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33418.exe
        8⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        8⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        8⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        7⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        7⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        7⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30410.exe
        6⤵
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        5⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53813.exe
        6⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10643.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        7⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        6⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61476.exe
      4⤵
      PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        5⤵
        
        PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
      4⤵
      PID:11444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
      4⤵
      PID:17276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63575.exe
        6⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15369.exe
        7⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        7⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        6⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        5⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        6⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33354.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        5⤵
        
        PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        6⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      4⤵
      PID:16484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-996.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        6⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        5⤵
        
        PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38069.exe
        5⤵
        
        PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
      4⤵
      PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
      4⤵
      PID:17312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
      4⤵
      PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60468.exe
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
      4⤵
      PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
    3⤵
    PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
      4⤵
      PID:14756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13586.exe
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65347.exe
    3⤵
    PID:2584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        9⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        9⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        9⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        8⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        8⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        7⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27364.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        8⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        6⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        7⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        7⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        7⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        7⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        6⤵
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44653.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        5⤵
        
        PID:13668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        6⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        5⤵
        
        PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        6⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        7⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        7⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        6⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
      4⤵
      PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        5⤵
        
        PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
      4⤵
      PID:15088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        5⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        7⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        6⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41405.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        6⤵
        
        PID:17140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        5⤵
        
        PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
      4⤵
      PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
        5⤵
        
        PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        5⤵
        
        PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
      4⤵
      PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        5⤵
        
        PID:13432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      4⤵
      PID:14472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61364.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
        6⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        7⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        6⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        6⤵
        
        PID:17132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        5⤵
        
        PID:10972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        5⤵
        
        PID:15800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15800 -s 236
        6⤵
        Program crash
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        5⤵
        
        PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
      4⤵
      PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
      4⤵
      PID:16440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        5⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        5⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        5⤵
        
        PID:14296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14296 -s 468
        6⤵
        Program crash
        
        PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
      4⤵
      PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
        5⤵
        
        PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
      4⤵
      PID:10944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
    3⤵
    PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
      4⤵
      PID:10948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      4⤵
      PID:14248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
    3⤵
    PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
      4⤵
      PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33076.exe
      4⤵
      PID:15788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
    3⤵
    PID:12376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42581.exe
    3⤵
    PID:15960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        7⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        6⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        7⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        6⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        7⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30410.exe
        6⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
        5⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11459.exe
        5⤵
        
        PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        5⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      4⤵
      PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        5⤵
        
        PID:14904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
      4⤵
      PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
      4⤵
      PID:16124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48877.exe
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
        6⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        5⤵
        
        PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        5⤵
        
        PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
      4⤵
      PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        5⤵
        
        PID:3588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 464
        6⤵
        Program crash
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
      4⤵
      PID:16160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        5⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        7⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
        6⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        5⤵
        
        PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
      4⤵
      PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        5⤵
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
      4⤵
      PID:15996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
    3⤵
    PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
      4⤵
      PID:3124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
    3⤵
    PID:12580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        8⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26273.exe
        7⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        6⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32368.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        6⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        5⤵
        
        PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        5⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        5⤵
        
        PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exe
      4⤵
      PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
      4⤵
      PID:11452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exe
      4⤵
      PID:16180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        6⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        5⤵
        
        PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        5⤵
        
        PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59678.exe
      4⤵
      PID:15156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
      4⤵
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
        5⤵
        
        PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
      4⤵
      PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
      4⤵
      PID:13640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
    3⤵
    PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
      4⤵
      PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
      4⤵
      PID:16920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
    3⤵
    PID:11124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
    3⤵
    PID:17088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12563.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        6⤵
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        5⤵
        
        PID:13352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
      4⤵
      PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
      4⤵
      PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe
      4⤵
      PID:16336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
    3⤵
    PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        5⤵
        
        PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
      4⤵
      PID:13200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
    3⤵
    PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
    3⤵
    PID:11336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
        5⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
      4⤵
      PID:15936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
    3⤵
    PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35507.exe
      4⤵
      PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      4⤵
      PID:16104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
    3⤵
    PID:11544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
    3⤵
    PID:16172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
  2⤵
  PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
    3⤵
    PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      4⤵
      PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
      4⤵
      PID:9716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
    3⤵
    PID:9988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19747.exe
    3⤵
    PID:10896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
  2⤵
  PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
    3⤵
    PID:10520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
  2⤵
  PID:8044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
  2⤵
  PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 14204 -ip 14204
1⤵
PID:13316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 14248 -ip 14248
1⤵
PID:13336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 13952 -ip 13952
1⤵
PID:14732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 14212 -ip 14212
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 14296 -ip 14296
1⤵
PID:14800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 15800 -ip 15800
1⤵
PID:16212

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:16048

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:16120

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1908

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17192

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17180

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:16056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10643.exe

Filesize
468KB

MD5
5bffe1a643c117032e1658ad0248054b

SHA1
7b71085ee25ea2205b78edd816e70b9fe06d5f44

SHA256
11b5053ebfc1ce95c3f740b097666b0640fa2546fc6b94852e4d98315c6612a0

SHA512
e4a25957f7ae6b02e61095d516517b614ce6535842ed9ddf12805c2358f792df71848ab9d1621c6d7143ef61fa044a37664a4976bbe91a098f1403b0a3f1dce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe

Filesize
468KB

MD5
9c714bddfbe73c507695d8fab737a64d

SHA1
f38d6ad9e3c1da087d1451f94852d186db2d566b

SHA256
0c4a7aefa9db83034fc8ec3c6e2241cd5911342cc15a880ec99d3880de026a42

SHA512
387f1288de5ab5bc2ab21dfb9095ce9081d102bd3811b4be444559c831ead5debc633d837a4a427a241a615faf29f9672e6d2c559673c87c5668932d3e8ef48a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12433.exe

Filesize
468KB

MD5
8ea2863d3b6b1e664c8fb9f2060fdc38

SHA1
e9fa54d4cafc7a07888a18e59bce3c8e0634e89c

SHA256
50ae7a22309a0b0ac9656ddc1aca075294244befee6ede9b351fee66f4461b11

SHA512
2fd237e37c982b496f008e5e94a6e68f8686eb7a1162f9525a59f7adcd9c2a03c82a143a7538469c20ac69113a2e200ed770a198fef7b2a067c851132d7d239d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe

Filesize
468KB

MD5
245ee53aacabdc68e6ffc6826deff173

SHA1
0aaf3d746123054ca7986879feedb7eb80f4b2b2

SHA256
94efea75f024ef20d56445e4029245e431e7fc6caa0a5c866926a3a48abbe834

SHA512
986bac745c40ad7a209d116752e1e94bafb0b90663afe245dfc5ee5169252c6a6a15609489bf6e17b8bd019f7eb504e4dd14166a5953244aaadb3a604f150e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe

Filesize
468KB

MD5
af338d24464b764e4a0d142773cd4e2c

SHA1
4354c4be75b034d5179a08e9ffafc2865b091c7c

SHA256
a30f73f268a3cc3527cfd431eeeeb61d6c75cd30b5ec7ca476b4ecfb43caffef

SHA512
ed476c93867491037f4f6bf67cf104d662fdc2b6456b15c0b0b9defe67ca215aa2d83a11ef71fe159fcb2df2de3144469c33b0da065a2039bfd2f7d258a44723

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13923.exe

Filesize
468KB

MD5
f627ac2bea424496c5d63fbae214cecb

SHA1
7e40fa626acab8a996da5acd1b82b9dbb6776a63

SHA256
cdcb369545e1efc77221ab55330ee1ba48eca771f5e36b19e652a3de24a04114

SHA512
d2070d4e64b69dd6608cd59075ea8680a3d3d80e5bdf2863173dea0add40c680b22ebe445d19ad60a44bd0904c0a2cc1f9578ba3cfc2fa453555398e327191ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe

Filesize
468KB

MD5
fef20c83f6bef7fccc3b6d3ccae14584

SHA1
fcaf7ee7daa289cf0beda96fb9f539ba2e6b6e6e

SHA256
bd76b5e81d05342430747fe3874a256e17c7a78755050904d87b8bd6438c557a

SHA512
59b27522449ec6aa96292f58b8c1cdc113e19bd2a0d13ea1708d6613d275ec7b2bf7018b9a74f05488754b02daceee6f93b639c4027fced21210277e80d8c8c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17642.exe

Filesize
468KB

MD5
ef242a0b4c69416477375038739dd13d

SHA1
f13f22fa1ffb0973b382991a3c353f1202655b6e

SHA256
95b94aae2dc58d1facfea441c492d3370810a2250f6e492cbe052447b9f1d7be

SHA512
8e45f9a37afaf044626e8380dad75822b0f44e48a4df14f8893a6d8b362671f42918e9a42a377c15633c26e19d9b20380378d4381000536dde305fe1dc6dd82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe

Filesize
468KB

MD5
25dd46fb3f8df91406e6fec0b339d93c

SHA1
4b845f9fda6971b3733ef597ce2019bd8ddf684a

SHA256
737e4ebb78765311d293fa37609d601099ba41497871c6eb68bb2fd5df33edd8

SHA512
11e6985786fe7c252502067e9610dabc171f926c2aa8fc3c6f9be0bbaeb637d7250879b67ee66c3dc564185aebe55dd1128e73239dea8738e3d6c65475254898

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

Filesize
468KB

MD5
77f3dc7b4b4c946d89b6a4017e4dcd59

SHA1
fbb35d9dff41984573e03d94efda789848421313

SHA256
ffe962b2c1e04c68e973e6936dfecdeef3d83d3de98b1ef6e63f65935fd95cb2

SHA512
1248b45f1f7550a45ed056c08eeae3298ad1a2bc40e41523a861ea531aea859104a4e494b02b3e8533b08c21d28b99039328d3e9d2ecdf64c84c1eb573fcceea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe

Filesize
468KB

MD5
41d4ba42ca2d23771ffa41a712f25573

SHA1
bd2a0678f28f07757d422a11117d800e524b89b6

SHA256
66fa7a4139bb9c3f2ebc0638d08ba2357705fe8fda9770f6b964a723b158c06f

SHA512
b5e5a15111f4e85b9a36fa3b1c4082a00aa3a3e4bd88a6514c1e513ed663a4a62300c588df1e3b0501c9ff010fed309f6440cb0a72a500c6b7f12189b08986e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe

Filesize
468KB

MD5
a9a893f238eeb3862ca60120c47b0243

SHA1
c04142388df25aaea7ebbaf74f02a912115e333d

SHA256
41cb1febc99ea947a9b6652809174bdeebd3ecc1e5b72772094fa7aa0ddd9119

SHA512
13c337f64c6d7e0ff8a99b60030fbe9dc82a88a76ff9409c154be67dc52c20e27a7a66573b5157e87371c78643511f8708b24c0269b40c21461f2a0416f1179b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe

Filesize
468KB

MD5
552faa3395fa12983f19ff05339b25bc

SHA1
322c139e2c5fcbaa67481b8d7a65a87de02dceaa

SHA256
e33a4402886eec1dfdaf93e3ee1883d5d708699b899827a852ffcd9553be151f

SHA512
8d242631d675493e78322f8e1ca181282625d8f526f33da65be2c8c9a0e81321b0eaea2b75a3e5b6c841ae7b78e74b27ff79066398665b8e928c39a9b6257222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe

Filesize
468KB

MD5
aeecaa8970f6ed93b942528ab738ac4e

SHA1
a0dbfc853100b1cc22c9910f01c1d7c044fb3f9f

SHA256
7d8d5665df76a40c0b3a244db8fd23200c6d4fc6758b0e46add1dc16947b7845

SHA512
43ef9a36ade7b3a10c257b4c06e3fa3de866915b9cea25f64c17a6eca73e832ff8461bef1f6088a71b34a6d0fc934a95f3cfeb4452ce62702a94ad66f556a49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe

Filesize
468KB

MD5
7853d59e231e6ee9ad0004f5c2fa6a7e

SHA1
190bac35ef0e53e770a712746865ea1cf28bc715

SHA256
09e50b3f00875a27f31f2814c1ccc4f5bb847a6defc929de442fffa6222b206f

SHA512
79115e8c9147eb9466d6ddbe75d367fa8f138d0c84b9eb4b448462e5c7d57c76d6237cdbd7727590088ee0fdc6b3fed48f3620039b78720d3d9f2346fc4cfba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe

Filesize
468KB

MD5
8b4219da7dfc059011ee8d6f4eb14dac

SHA1
fb03d6d894e256597160be68c2029f5885b677ae

SHA256
fd05ec86cc3a06bf4c456fb3b9eb0c1fa4b87f9afdee9cab56cb44fa2600ae7f

SHA512
708c7de754a63646bc57536886e312124eb44c1a1daaa294ff83400ec0e9d4b76e28af7f3e4856d31c4ea703f7de6d44ccf66a998dcb8aee999815b619d89891

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe

Filesize
468KB

MD5
86b19385298d681fcbd2d934cc52b353

SHA1
9e1d7701ca8e28109b206d21b6eb22ddd6f4cd05

SHA256
d3f40ab7079bb2b98bf4c2e97cd562818338e879566a1f00fd254c1132dfe64b

SHA512
6f528abf6a334cc39549cfe3f5ef98f3477f7ef400c01566dcbad7059659ade202d00cf3735a8d0a69bfaaae42ab67500d036eec446d4a1cb51576ea5606ffb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30980.exe

Filesize
468KB

MD5
1ef1fb204aa9f896812d81027d1c52af

SHA1
a8eafe7b3e5b7ed173d82eae8ad7694e8f6678d8

SHA256
55a6f9e2dad2361c2dc3222e5a5079023000a39d4ecc201d6ecd2b393603326b

SHA512
3d65eb92763ccad6ac12ced136564898427248d0369c680676995a7687366e85ed5fc992d6e1ce6408204715395bae5414fbeea1f2d096e44f767272ed099bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe

Filesize
468KB

MD5
2a5221e6929402503b97ff52a8583ea9

SHA1
775cc0a2069d5698d9bb79aa7da6616a2b594d4d

SHA256
faabadd9edbac16b961c7f6d63985cb07c4245f3e5b8d90d50107e040f1b9230

SHA512
202562ae5c2570fb999d675c0244ec01b34b07f8facf99825c58bc6a8962c29d79c23ce23bb8197deadcc296e2fa6fe49f65b37e6e85cdc0ee61a7b5ee1e8e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe

Filesize
468KB

MD5
aed589a7dd7f290ad5bbab4181eafb77

SHA1
7467a1d86d1217fc189fe70442fc383d9fa943df

SHA256
0c1a1044f34a977d4bffd31970cfec7b512bdff317861f401494559c558719f7

SHA512
a37afcb4a47634eec324fc65c3943ded582be5f73755176dad79cea327ee0b5579b569fd4ead305859f5b331331e48edaf16443861b7d1a936f5ebaeaa88c9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe

Filesize
468KB

MD5
e073481d20a6e6ee08975cef6752af25

SHA1
2a1b9a2594efca2b8eba20b8d70bbace411edae6

SHA256
d59e69489266a4e5e41400fee6fba369ac2fe38a3b2fd184c31a4bf7e410324c

SHA512
fab843a2efbefa23896d219ee4e1201e6bab642df60f60ea07ab8a2ac741d6c425ed78f97b8e80982c7f9121760201cfa612be42ca434760dd0e5e722c309e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe

Filesize
468KB

MD5
7eb192df76f6f91ea736cb9531b9bf3e

SHA1
c48c76f08da61a2e02e13f264a4d2da4270d3712

SHA256
5b330f48a1ddff34f2ee62cba9617989cfd836b2cccae13c2439eeecf8664a53

SHA512
1d46a52351adfe997637085f7a4bea81c0722f53920aa2e9ff9288b58668bd4f619d021ae4a55cda0c99bfc81239c721ada424ba668846a53514d3c8a626f367

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe

Filesize
468KB

MD5
0c9fe4b17191b2b6ce274c031c4def56

SHA1
afde6f56cebb5673bbe107540e1a6460d9632221

SHA256
ee7b30618f6484afbacfb63d22372df2881d2dfdb6940860a6412fcabc3b3dfc

SHA512
823c2cc49553109e24274c7d3ee2d23e1ef17e685e3df398ded9fbf8c329b5e5199e08601375c11af910586819559c4f90de9b464e0cde22ad914ff302d36789

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe

Filesize
468KB

MD5
bfbba024772fdca8df1da2574bd880c6

SHA1
d41886b56357ea9d73049b9d3547e2c0d046f2dd

SHA256
00ec3fb4cc05bd8285a42cf00c7076c21e791752ebc545b81cc637e4352497c9

SHA512
d6a0c868b929e68db635dbe3e032fc6c300ea8f43eb0cfd1149e627630baca2e89b84d708711ed3d8926e26103d3f1b952a21cb48b9438f32c8caf32ce344682

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe

Filesize
468KB

MD5
0bc9349ffb0c1d5861e270f5a4270ce1

SHA1
25812683754357ef52a4e4a52e1ffafda874b238

SHA256
074df3b88fff9bc9a235359b04514df690a84cee7bf565346b6a5e391c690c37

SHA512
ed370cf8b1ea6c6dff0477e6c76bffeffa3c668c4d906d496e0ce92a31bc5225ba552017b52a3e23ec71d73bb75c9805d150ad40fc09a2bbfe95fe24cd9bc590

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe

Filesize
468KB

MD5
99496ee0412cd42ad6382992f82ae5cf

SHA1
c37cc5b9b814584e5d02cf3edb4310688a60a894

SHA256
1995b2defeab8ebb15b220290d12c71bfd6084d295265b95968423601d41dd49

SHA512
8260765a84a8899dc082d6fb8cf9dae1b3ed347aab3dfcea90f31025d191c4af8ea300df166a160e3bd65220b53e52e2a3ba18105f02406b589215326591bc0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe

Filesize
468KB

MD5
9aa09470642a2e27f0bc206f9ae70b17

SHA1
dd1c89bd598d32535b59eed21d7adb9441a7f6fb

SHA256
185cb5b891e2b9bdec4ffc183ea9be2a6393a228b783fcf8e43928c00436ff8e

SHA512
460c7855e2301061bdaff57547bc608f8505b7b66b2b84d69bfe56f681e0e54497b76f5d427e646222f59076c7bf91c798193d57bba3df7e3c8926c8d17a86b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe

Filesize
468KB

MD5
17975d635936a8d1e8eda563fc2383f3

SHA1
59c37e7427feb6e89e8fae93ff7b12b433a74341

SHA256
580ad241b67be06767fb9841850c6dd4ef6428d7d78771dc0df153fedbec7561

SHA512
c925dd00a237c9cdd02c5cad9de87a15612a32bee4ca1a1cc8bc3afb634c3a82a12f61ea87af06b15cd76005138bf16c7369f08b028c3f637ac6044cda3cb844

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe

Filesize
468KB

MD5
df3e076fca3b9de78eeca5ecd82ec303

SHA1
f22853ff6404fccb237d8808eedd6fd0cfe6a837

SHA256
06e31bdc6de6c989f56dc37a35f5c35bdcbce786306bced9ab4a52ccfb533ed9

SHA512
51f4bdf674fa0b2cabfe71e30cf231b098cfd9387064066240f47c135683c083dc1f3e71dcd8a5fcde0471e6911f146199ae02d0ca9276efbf801d22ed8169a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe

Filesize
468KB

MD5
cb58540975a954464ebe448a7689ba4d

SHA1
ce6bf6837848e706e2ccb156748a125426170aa2

SHA256
cff265d5cc89c91480a96a58e206580fb6b1210f8f0f5158de30bfd80c8e5458

SHA512
358fdb63fca1ed2600e6a1cbd9aeb625ecb8c3b74b741de5cea1e176db3fbe05727953c720d3567eb52520a7ec5301eb4d7f2f2a2d8bbe7faad2bedbc4aabaec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe

Filesize
468KB

MD5
8a47e5434c511a756b91a6d7b71f6a0e

SHA1
dc4f5c174da9b43eb9b66f026df0a34f414e052b

SHA256
966a11f6836643dac1d3a823ae2b15efd0b071bb0b170799447efbe01df97fdd

SHA512
f808226b4d0eaab1a4d46c682778d7b6a064499855b4a13499f5593195eee99a1a1aaee88f5399cff8bb97d985f5fb89e8c0fd4329ae074d3b5d659e542a307e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe

Filesize
468KB

MD5
dd9bf0218544522ca56cfb3bb981a818

SHA1
ca8388aed2dda2d3534cc653894af29e53eb7af9

SHA256
4a3b45387ab8727e3c71bbb878c6e6ce08127dcfcb2b444baafbb18df186dd8d

SHA512
a4ac0bedfcaed808d5056dc10096452b6711f5fb91924da844e30c3f01fcde6fc6283ba6c258bd4d3aed9c3f8625383849226738a688e31abe34ea7668f675ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe

Filesize
468KB

MD5
0fbe3580b42851f86931e9265c1c7cbe

SHA1
9a995f8564c1e6a322bde92f761e25d9eba4623f

SHA256
9373a1173e1cb60d9f769aaf70bdd9b34e4b0767c1b4c47e48b143e634c30286

SHA512
1fcef9c38341c6b86303c6f3e6ff5ca073b49988956aa10e2191c90a5e6c8cd67ec1402286d32fa2656386bf66a509377db5fb9ac83c76fe0579ef712a867d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe

Filesize
468KB

MD5
4007ccdf7abb0937d539336e7d5908e4

SHA1
2478acd39f471141cfe07cb2481c099198ea756d

SHA256
17b29763bf129e333cfc18498a1c22a93ad4c38d8a52df671830c16821e3a10d

SHA512
10829317d09d11787ffadf21a9c195761620243e090b7d9f257e9836ee1a31c1b5cb7307a64683cde606fb3e7ef9e42d64b6c63ed5d9b499503ccf2cd12feaec

Download Submit
memory/8-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/228-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/896-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1012-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-2886-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3340-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3724-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3832-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4040-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4672-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5044-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5600-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5640-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5760-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14212-2923-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14744-2434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14776-2435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14820-2436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16004-2884-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16004-2885-0x0000000077640000-0x00000000776BA000-memory.dmp

Filesize
488KB

Download
memory/16280-2935-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16308-2941-0x00007FF91D290000-0x00007FF91D485000-memory.dmp

Filesize
2.0MB

Download