443dcd8105f12eda82a2ac74f59937c035458bd615342bc9471aabb8c7308443

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cab50b600d6eba85f94e3e4d0b2b1230N.exe
Size

468KB
MD5

cab50b600d6eba85f94e3e4d0b2b1230
SHA1

6de5ee70b383d308b2114e7d24e712e962918c46
SHA256

443dcd8105f12eda82a2ac74f59937c035458bd615342bc9471aabb8c7308443
SHA512

5c0ace8ad0bc2cc6a41758f1c329c8cfa75066243cf66c87948d890450a2beabb19cbc8971323022489a374d05858dacc91360d95458c1550e2ed7573f50e89c
SSDEEP

3072:mrz7ogKxjz8YFbYVPz3yqf8/Zptj7ApgPmHx+lOXEln0QcRqSDl5:mrfotAYF2PDyqfE8tdEl05RqS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2776	Unicorn-12492.exe
3492	Unicorn-40732.exe
5016	Unicorn-60598.exe
1748	Unicorn-49389.exe
4488	Unicorn-21355.exe
4296	Unicorn-35091.exe
1572	Unicorn-65061.exe
3376	Unicorn-28859.exe
2304	Unicorn-32389.exe
5072	Unicorn-26258.exe
3688	Unicorn-41361.exe
4100	Unicorn-18357.exe
4744	Unicorn-30971.exe
4992	Unicorn-23318.exe
3504	Unicorn-48599.exe
3360	Unicorn-54729.exe
4448	Unicorn-50645.exe
2472	Unicorn-42477.exe
1152	Unicorn-25378.exe
3132	Unicorn-29960.exe
3776	Unicorn-10359.exe
5100	Unicorn-44937.exe
312	Unicorn-12819.exe
3616	Unicorn-63503.exe
4956	Unicorn-4096.exe
2532	Unicorn-24325.exe
1364	Unicorn-47713.exe
4168	Unicorn-37537.exe
1548	Unicorn-1335.exe
2748	Unicorn-780.exe
4768	Unicorn-8948.exe
4620	Unicorn-41536.exe
4352	Unicorn-1465.exe
1932	Unicorn-25647.exe
4356	Unicorn-37345.exe
3012	Unicorn-17479.exe
2912	Unicorn-32996.exe
452	Unicorn-33261.exe
728	Unicorn-16162.exe
412	Unicorn-18962.exe
2664	Unicorn-27973.exe
372	Unicorn-37210.exe
316	Unicorn-62461.exe
5092	Unicorn-42071.exe
1056	Unicorn-23697.exe
1348	Unicorn-23697.exe
332	Unicorn-15528.exe
3224	Unicorn-15528.exe
3336	Unicorn-3011.exe
1976	Unicorn-40395.exe
1160	Unicorn-40395.exe
224	Unicorn-54131.exe
2980	Unicorn-3769.exe
1792	Unicorn-6976.exe
2996	Unicorn-4921.exe
1604	Unicorn-25019.exe
3460	Unicorn-18334.exe
2556	Unicorn-28911.exe
4800	Unicorn-7936.exe
1696	Unicorn-40417.exe
700	Unicorn-40417.exe
64	Unicorn-40417.exe
4236	Unicorn-11828.exe
760	Unicorn-11828.exe

Program crash 43 IoCs

pid	pid_target	Process	procid_target
804	5016	WerFault.exe	93
3204	4296	WerFault.exe	98
208	1152	WerFault.exe	117
5636	224	WerFault.exe	152
5484	3336	WerFault.exe	149
6560	4236	WerFault.exe	163
5148	3132	WerFault.exe	118
4388	312	WerFault.exe	121
7024	5724	WerFault.exe	198
8084	5368	WerFault.exe	243
9436	6480	WerFault.exe	257
8076	5428	WerFault.exe	244
7608	3376	WerFault.exe	104
9576	4064	WerFault.exe	319
9264	6516	WerFault.exe	259
9308	6652	WerFault.exe	331
9412	2012	WerFault.exe	330
2056	316	WerFault.exe	143
12092	7324	WerFault.exe	347
12608	8872	WerFault.exe	415
6040	6692	WerFault.exe	304
15184	8760	WerFault.exe	410
13524	10184	WerFault.exe	542
6576	3220	WerFault.exe	166
2960	8048	WerFault.exe	589
4736	6092	WerFault.exe	233
7984	1160	Process not Found	151
16312	5576	Process not Found	193
13220	6708	Process not Found	288
14588	3968	Process not Found	165
1632	4352	Process not Found	132
12040	9696	Process not Found	515
16596	6816	Process not Found	316
656	744	Process not Found	533
17080	5664	Process not Found	1066
4488	8768	Process not Found	411
1632	8620	Process not Found	406
8596	8300	Process not Found	390
8092	220	Process not Found	323
8160	1940	Process not Found	238
5068	9520	Process not Found	557
10072	7660	Process not Found	384
4024	8600	Process not Found	404

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26513.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe
2776	Unicorn-12492.exe
3492	Unicorn-40732.exe
5016	Unicorn-60598.exe
1748	Unicorn-49389.exe
4488	Unicorn-21355.exe
4296	Unicorn-35091.exe
1572	Unicorn-65061.exe
3376	Unicorn-28859.exe
5072	Unicorn-26258.exe
2304	Unicorn-32389.exe
3688	Unicorn-41361.exe
4100	Unicorn-18357.exe
4744	Unicorn-30971.exe
4992	Unicorn-23318.exe
3360	Unicorn-54729.exe
4448	Unicorn-50645.exe
1152	Unicorn-25378.exe
2472	Unicorn-42477.exe
3132	Unicorn-29960.exe
3504	Unicorn-48599.exe
3776	Unicorn-10359.exe
5100	Unicorn-44937.exe
312	Unicorn-12819.exe
4956	Unicorn-4096.exe
3616	Unicorn-63503.exe
2532	Unicorn-24325.exe
1364	Unicorn-47713.exe
4168	Unicorn-37537.exe
1548	Unicorn-1335.exe
2748	Unicorn-780.exe
1932	Unicorn-25647.exe
4768	Unicorn-8948.exe
4356	Unicorn-37345.exe
412	Unicorn-18962.exe
452	Unicorn-33261.exe
4620	Unicorn-41536.exe
3012	Unicorn-17479.exe
4352	Unicorn-1465.exe
2912	Unicorn-32996.exe
728	Unicorn-16162.exe
2664	Unicorn-27973.exe
372	Unicorn-37210.exe
316	Unicorn-62461.exe
5092	Unicorn-42071.exe
1056	Unicorn-23697.exe
1160	Unicorn-40395.exe
1976	Unicorn-40395.exe
224	Unicorn-54131.exe
3336	Unicorn-3011.exe
3224	Unicorn-15528.exe
332	Unicorn-15528.exe
1348	Unicorn-23697.exe
2980	Unicorn-3769.exe
1792	Unicorn-6976.exe
3460	Unicorn-18334.exe
1604	Unicorn-25019.exe
2996	Unicorn-4921.exe
2556	Unicorn-28911.exe
4800	Unicorn-7936.exe
1696	Unicorn-40417.exe
700	Unicorn-40417.exe
64	Unicorn-40417.exe
4236	Unicorn-11828.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2776	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	89
PID 4912 wrote to memory of 2776	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	89
PID 4912 wrote to memory of 2776	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	89
PID 4912 wrote to memory of 3492	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	92
PID 4912 wrote to memory of 3492	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	92
PID 4912 wrote to memory of 3492	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	92
PID 2776 wrote to memory of 5016	2776	Unicorn-12492.exe	93
PID 2776 wrote to memory of 5016	2776	Unicorn-12492.exe	93
PID 2776 wrote to memory of 5016	2776	Unicorn-12492.exe	93
PID 3492 wrote to memory of 1748	3492	Unicorn-40732.exe	96
PID 3492 wrote to memory of 1748	3492	Unicorn-40732.exe	96
PID 3492 wrote to memory of 1748	3492	Unicorn-40732.exe	96
PID 2776 wrote to memory of 4488	2776	Unicorn-12492.exe	97
PID 2776 wrote to memory of 4488	2776	Unicorn-12492.exe	97
PID 2776 wrote to memory of 4488	2776	Unicorn-12492.exe	97
PID 4912 wrote to memory of 4296	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	98
PID 4912 wrote to memory of 4296	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	98
PID 4912 wrote to memory of 4296	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	98
PID 1748 wrote to memory of 1572	1748	Unicorn-49389.exe	103
PID 1748 wrote to memory of 1572	1748	Unicorn-49389.exe	103
PID 1748 wrote to memory of 1572	1748	Unicorn-49389.exe	103
PID 3492 wrote to memory of 3376	3492	Unicorn-40732.exe	104
PID 3492 wrote to memory of 3376	3492	Unicorn-40732.exe	104
PID 3492 wrote to memory of 3376	3492	Unicorn-40732.exe	104
PID 4488 wrote to memory of 2304	4488	Unicorn-21355.exe	105
PID 4488 wrote to memory of 2304	4488	Unicorn-21355.exe	105
PID 4488 wrote to memory of 2304	4488	Unicorn-21355.exe	105
PID 2776 wrote to memory of 5072	2776	Unicorn-12492.exe	106
PID 2776 wrote to memory of 5072	2776	Unicorn-12492.exe	106
PID 2776 wrote to memory of 5072	2776	Unicorn-12492.exe	106
PID 4912 wrote to memory of 3688	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	107
PID 4912 wrote to memory of 3688	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	107
PID 4912 wrote to memory of 3688	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	107
PID 1572 wrote to memory of 4100	1572	Unicorn-65061.exe	110
PID 1572 wrote to memory of 4100	1572	Unicorn-65061.exe	110
PID 1572 wrote to memory of 4100	1572	Unicorn-65061.exe	110
PID 1748 wrote to memory of 4744	1748	Unicorn-49389.exe	111
PID 1748 wrote to memory of 4744	1748	Unicorn-49389.exe	111
PID 1748 wrote to memory of 4744	1748	Unicorn-49389.exe	111
PID 3376 wrote to memory of 4992	3376	Unicorn-28859.exe	112
PID 3376 wrote to memory of 4992	3376	Unicorn-28859.exe	112
PID 3376 wrote to memory of 4992	3376	Unicorn-28859.exe	112
PID 3492 wrote to memory of 3504	3492	Unicorn-40732.exe	113
PID 3492 wrote to memory of 3504	3492	Unicorn-40732.exe	113
PID 3492 wrote to memory of 3504	3492	Unicorn-40732.exe	113
PID 3688 wrote to memory of 3360	3688	Unicorn-41361.exe	114
PID 3688 wrote to memory of 3360	3688	Unicorn-41361.exe	114
PID 3688 wrote to memory of 3360	3688	Unicorn-41361.exe	114
PID 5072 wrote to memory of 4448	5072	Unicorn-26258.exe	115
PID 5072 wrote to memory of 4448	5072	Unicorn-26258.exe	115
PID 5072 wrote to memory of 4448	5072	Unicorn-26258.exe	115
PID 2304 wrote to memory of 2472	2304	Unicorn-32389.exe	116
PID 2304 wrote to memory of 2472	2304	Unicorn-32389.exe	116
PID 2304 wrote to memory of 2472	2304	Unicorn-32389.exe	116
PID 4912 wrote to memory of 1152	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	117
PID 4912 wrote to memory of 1152	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	117
PID 4912 wrote to memory of 1152	4912	cab50b600d6eba85f94e3e4d0b2b1230N.exe	117
PID 2776 wrote to memory of 3132	2776	Unicorn-12492.exe	118
PID 2776 wrote to memory of 3132	2776	Unicorn-12492.exe	118
PID 2776 wrote to memory of 3132	2776	Unicorn-12492.exe	118
PID 4488 wrote to memory of 3776	4488	Unicorn-21355.exe	119
PID 4488 wrote to memory of 3776	4488	Unicorn-21355.exe	119
PID 4488 wrote to memory of 3776	4488	Unicorn-21355.exe	119
PID 4100 wrote to memory of 5100	4100	Unicorn-18357.exe	120

C:\Users\Admin\AppData\Local\Temp\cab50b600d6eba85f94e3e4d0b2b1230N.exe
"C:\Users\Admin\AppData\Local\Temp\cab50b600d6eba85f94e3e4d0b2b1230N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 632
      4⤵
      Program crash
      PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32389.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-780.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38601.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
        9⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        10⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        11⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        10⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41568.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        9⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        10⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        9⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        8⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
        9⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58165.exe
        9⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        10⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        10⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        9⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
        9⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        9⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        8⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        8⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        8⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        7⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        9⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        10⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        10⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        9⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        8⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        9⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        7⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        6⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        6⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        6⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7656.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        9⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 604
        9⤵
        Program crash
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54287.exe
        6⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        8⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        6⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        5⤵
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        5⤵
        
        PID:5428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 640
        6⤵
        Program crash
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        5⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        6⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        5⤵
        
        PID:14236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        9⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51253.exe
        10⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59400.exe
        9⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
        9⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        9⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        8⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        8⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
        9⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        9⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        7⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        7⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25057.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        8⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        7⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        6⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        5⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        6⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62220.exe
        5⤵
        
        PID:12996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18962.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        5⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        9⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        9⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        9⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7280.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        7⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        6⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        7⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        6⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 692
        7⤵
        Program crash
        
        PID:2960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 660
        6⤵
        Program crash
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
      4⤵
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        5⤵
        
        PID:6652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 632
        6⤵
        Program crash
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe
        5⤵
        
        PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
      4⤵
      PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        5⤵
        
        PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      4⤵
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
      4⤵
      PID:12368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        9⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        10⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        9⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        9⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        10⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8760 -s 656
        9⤵
        Program crash
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        8⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        6⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 632
        7⤵
        Program crash
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
        6⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        7⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        7⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
        6⤵
        
        PID:13404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        5⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        7⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 484
        7⤵
        Program crash
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        8⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        7⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        5⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        6⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        5⤵
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        8⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        9⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
        9⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        9⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        8⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        7⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53328.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        6⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 604
        7⤵
        Program crash
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        6⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        7⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        5⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        6⤵
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        6⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
      4⤵
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        7⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        6⤵
        
        PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42093.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        7⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56723.exe
      4⤵
      PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        5⤵
        
        PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      4⤵
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
      4⤵
      PID:9292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        5⤵
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
        8⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8256.exe
        9⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        9⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        8⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        6⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        7⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exe
        5⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        6⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        5⤵
        
        PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
      4⤵
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        5⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        6⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        5⤵
        
        PID:14868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 748
      4⤵
      Program crash
      PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16162.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
      4⤵
      Executes dropped EXE
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        8⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe
        7⤵
        
        PID:13068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        6⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14068.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        7⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        6⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54164.exe
        5⤵
        
        PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      4⤵
      PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        5⤵
        
        PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3131.exe
      4⤵
      PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
      4⤵
      PID:14884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
    3⤵
    PID:740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        5⤵
        
        PID:12608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
    3⤵
    PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
      4⤵
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6516 -s 636
      4⤵
      Program crash
      PID:9264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
      4⤵
      PID:10700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
      4⤵
      PID:15240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
    3⤵
    PID:7284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38217.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        9⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        10⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        11⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        10⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        9⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        9⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        9⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        9⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        10⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        8⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        9⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        9⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
        10⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        8⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 720
        7⤵
        Program crash
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-552.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        9⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        9⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        8⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        7⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        8⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        7⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        6⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        7⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        9⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        10⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        11⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        11⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        11⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        10⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3678.exe
        10⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        10⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        9⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        10⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        10⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        9⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        9⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21238.exe
        9⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        9⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        9⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        8⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10183.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        9⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31578.exe
        10⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        9⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        9⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        8⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        7⤵
        
        PID:14472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 724
        6⤵
        Program crash
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        9⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        10⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        9⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        9⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        8⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        8⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        7⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        7⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        9⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        9⤵
        
        PID:14244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        7⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64584.exe
        6⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        6⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        7⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12234.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        6⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
        7⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        6⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        5⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        5⤵
        
        PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        9⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        10⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        9⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        10⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        9⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        9⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
        8⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24837.exe
        8⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        7⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        7⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        8⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        9⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        9⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64060.exe
        8⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20626.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        7⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        8⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24466.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        7⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
        6⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        7⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        6⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
        8⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        6⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        7⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2783.exe
        5⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        6⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
        5⤵
        
        PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43431.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        6⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        7⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        8⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        6⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        7⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        6⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        6⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        5⤵
        
        PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 720
        5⤵
        Program crash
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
      4⤵
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        6⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        7⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
        6⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        5⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      4⤵
      PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        5⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        6⤵
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44825.exe
      4⤵
      PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
      4⤵
      PID:13372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
      4⤵
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
        9⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        9⤵
        
        PID:14612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6692 -s 628
        8⤵
        Program crash
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        7⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
        7⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        7⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        6⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        7⤵
        
        PID:15224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54288.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        8⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        9⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        9⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
        8⤵
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        8⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        6⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15953.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        8⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        6⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
        7⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        7⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        6⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        7⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe
        6⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        7⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48499.exe
        6⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        5⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6480 -s 636
        8⤵
        Program crash
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
        6⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8872 -s 628
        7⤵
        Program crash
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55456.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        6⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        8⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        7⤵
        
        PID:14160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        6⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        7⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        6⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57411.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exe
        6⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 632
        5⤵
        Program crash
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        6⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        7⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        6⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        7⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        6⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        5⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        6⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
        5⤵
        
        PID:14636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 716
      4⤵
      Program crash
      PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 644
        6⤵
        Program crash
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        6⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        8⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        7⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        6⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10184 -s 632
        7⤵
        Program crash
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        5⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        6⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        5⤵
        
        PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
      4⤵
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        5⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
        6⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31578.exe
        7⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        6⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
      4⤵
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        6⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
      4⤵
      PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      4⤵
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62220.exe
      4⤵
      PID:13396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
      4⤵
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        5⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34377.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        7⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        7⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        5⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        6⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21217.exe
        6⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        7⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        6⤵
        
        PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
    3⤵
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        7⤵
        
        PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
    3⤵
    PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
      4⤵
      PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        5⤵
        
        PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
      4⤵
      PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
      4⤵
      PID:15860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
    3⤵
    PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
      4⤵
      PID:16060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
    3⤵
    PID:10196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
    3⤵
    PID:3992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 464
    3⤵
    - Program crash
    PID:3204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        9⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        9⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        8⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        8⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        7⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        6⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        7⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11422.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        8⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        7⤵
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        6⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        8⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        7⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        6⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
        6⤵
        
        PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
      4⤵
      PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        5⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
      4⤵
      PID:13400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        7⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 644
        8⤵
        Program crash
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
        6⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        7⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
        6⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        5⤵
        
        PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
      4⤵
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        5⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
        6⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        7⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        5⤵
        
        PID:8024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
      4⤵
      PID:5724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 720
        5⤵
        Program crash
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
      4⤵
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        5⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        6⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39569.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
    3⤵
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        6⤵
        
        PID:8312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exe
    3⤵
    PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
      4⤵
      PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
    3⤵
    PID:11088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
    3⤵
    PID:14280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 720
    3⤵
    - Program crash
    PID:208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60365.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16801.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        6⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56904.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
      4⤵
      PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        5⤵
        
        PID:15324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
      4⤵
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
      4⤵
      PID:14512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        5⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        6⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        6⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        5⤵
        
        PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        5⤵
        
        PID:14000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
  2⤵
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
    3⤵
    PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        5⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
    3⤵
    PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
    3⤵
    PID:10756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
    3⤵
    PID:14552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
  2⤵
  PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
    3⤵
    PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
      4⤵
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        5⤵
        
        PID:15576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      4⤵
      PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13174.exe
    3⤵
    PID:12988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
    3⤵
    PID:6672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
  2⤵
  PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
    3⤵
    PID:10596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
    3⤵
    PID:15124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
  2⤵
  PID:14288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5016 -ip 5016
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4296 -ip 4296
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1152 -ip 1152
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3336 -ip 3336
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 224 -ip 224
1⤵
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4236 -ip 4236
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1076 -ip 1076
1⤵
PID:6184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 452 -ip 452
1⤵
PID:6312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3132 -ip 3132
1⤵
PID:6420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 412 -ip 412
1⤵
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 372 -ip 372
1⤵
PID:6792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2664 -ip 2664
1⤵
PID:6900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5100 -ip 5100
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 312 -ip 312
1⤵
PID:7072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5724 -ip 5724
1⤵
PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3376 -ip 3376
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5368 -ip 5368
1⤵
PID:7296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5428 -ip 5428
1⤵
PID:7616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6480 -ip 6480
1⤵
PID:7684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5056 -ip 5056
1⤵
PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4344 -ip 4344
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 5740 -ip 5740
1⤵
PID:8204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6012 -ip 6012
1⤵
PID:8476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5864 -ip 5864
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6332 -ip 6332
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5828 -ip 5828
1⤵
PID:8092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6572 -ip 6572
1⤵
PID:8104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6360 -ip 6360
1⤵
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4168 -ip 4168
1⤵
PID:8960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1548 -ip 1548
1⤵
PID:8508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5444 -ip 5444
1⤵
PID:9368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4620 -ip 4620
1⤵
PID:9428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4456 -ip 4456
1⤵
PID:9444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2912 -ip 2912
1⤵
PID:9484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2996 -ip 2996
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4024 -ip 4024
1⤵
PID:9548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4956 -ip 4956
1⤵
PID:9556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 760 -ip 760
1⤵
PID:9624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4988 -ip 4988
1⤵
PID:9736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 740 -ip 740
1⤵
PID:9836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4252 -ip 4252
1⤵
PID:9884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5476 -ip 5476
1⤵
PID:9964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2360 -ip 2360
1⤵
PID:9972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4216 -ip 4216
1⤵
PID:9992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1604 -ip 1604
1⤵
PID:10100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1056 -ip 1056
1⤵
PID:10180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5192 -ip 5192
1⤵
PID:10216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5640 -ip 5640
1⤵
PID:8988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5016 -ip 5016
1⤵
PID:9012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6516 -ip 6516
1⤵
PID:8360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4064 -ip 4064
1⤵
PID:8316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6652 -ip 6652
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2012 -ip 2012
1⤵
PID:9852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 7204 -ip 7204
1⤵
PID:9976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5744 -ip 5744
1⤵
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5676 -ip 5676
1⤵
PID:9016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6016 -ip 6016
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5492 -ip 5492
1⤵
PID:7936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5908 -ip 5908
1⤵
PID:9280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5616 -ip 5616
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2620 -ip 2620
1⤵
PID:9480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6524 -ip 6524
1⤵
PID:10000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6680 -ip 6680
1⤵
PID:9672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5600 -ip 5600
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6136 -ip 6136
1⤵
PID:9032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5504 -ip 5504
1⤵
PID:6572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3628 -ip 3628
1⤵
PID:8568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5524 -ip 5524
1⤵
PID:6416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5952 -ip 5952
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6488 -ip 6488
1⤵
PID:10572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5392 -ip 5392
1⤵
PID:10784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5896 -ip 5896
1⤵
PID:10988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7052 -ip 7052
1⤵
PID:11148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6588 -ip 6588
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5840 -ip 5840
1⤵
PID:11072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 9132 -ip 9132
1⤵
PID:11284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3428 -ip 3428
1⤵
PID:11428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6972 -ip 6972
1⤵
PID:11848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4444 -ip 4444
1⤵
PID:12072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4100 -ip 4100
1⤵
PID:12172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2532 -ip 2532
1⤵
PID:12192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2980 -ip 2980
1⤵
PID:12208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 316 -ip 316
1⤵
PID:12228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5868 -ip 5868
1⤵
PID:12260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1688 -ip 1688
1⤵
PID:11116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 224 -ip 224
1⤵
PID:11780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7324 -ip 7324
1⤵
PID:11452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8872 -ip 8872
1⤵
PID:8020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6692 -ip 6692
1⤵
PID:12508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4236 -ip 4236
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6504 -ip 6504
1⤵
PID:13148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6344 -ip 6344
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 7364 -ip 7364
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 7588 -ip 7588
1⤵
PID:13648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 9064 -ip 9064
1⤵
PID:13804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6268 -ip 6268
1⤵
PID:13932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6792 -ip 6792
1⤵
PID:14148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 824 -ip 824
1⤵
PID:14292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 7432 -ip 7432
1⤵
PID:12984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 9184 -ip 9184
1⤵
PID:13640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7192 -ip 7192
1⤵
PID:13332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 8236 -ip 8236
1⤵
PID:13524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 7228 -ip 7228
1⤵
PID:13836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6204 -ip 6204
1⤵
PID:14272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 536 -ip 536
1⤵
PID:13164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3336 -ip 3336
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7176 -ip 7176
1⤵
PID:13552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 6744 -ip 6744
1⤵
PID:14220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7340 -ip 7340
1⤵
PID:7304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 8264 -ip 8264
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3480 -ip 3480
1⤵
PID:13444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 7544 -ip 7544
1⤵
PID:7588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6380 -ip 6380
1⤵
PID:13456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7536 -ip 7536
1⤵
PID:13520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5760 -ip 5760
1⤵
PID:12676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5352 -ip 5352
1⤵
PID:13928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5916 -ip 5916
1⤵
PID:14616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6576 -ip 6576
1⤵
PID:15164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6152 -ip 6152
1⤵
PID:7960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6540 -ip 6540
1⤵
PID:13524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5960 -ip 5960
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6772 -ip 6772
1⤵
PID:15020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7416 -ip 7416
1⤵
PID:15056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3180 -ip 3180
1⤵
PID:14604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4592 -ip 4592
1⤵
PID:14644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5168 -ip 5168
1⤵
PID:14684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6160 -ip 6160
1⤵
PID:12680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 6120 -ip 6120
1⤵
PID:7228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 8824 -ip 8824
1⤵
PID:14896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8760 -ip 8760
1⤵
PID:13992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3220 -ip 3220
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 10184 -ip 10184
1⤵
PID:7420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 7160 -ip 7160
1⤵
PID:14828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5452 -ip 5452
1⤵
PID:6916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5268 -ip 5268
1⤵
PID:6152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5092 -ip 5092
1⤵
PID:14688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1792 -ip 1792
1⤵
PID:8824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8656 -ip 8656
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 9176 -ip 9176
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7404 -ip 7404
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 8884 -ip 8884
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6668 -ip 6668
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 9080 -ip 9080
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 7184 -ip 7184
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5664 -ip 5664
1⤵
PID:7276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6672 -ip 6672
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6660 -ip 6660
1⤵
PID:14680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 8808 -ip 8808
1⤵
PID:13440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 7120 -ip 7120
1⤵
PID:12692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 8048 -ip 8048
1⤵
PID:4440

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6092 -ip 6092
1⤵
PID:14248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe

Filesize
468KB

MD5
9b66db5f0d7429db694a9d5dd43ade0b

SHA1
c7bcbde49da0584a51dadcc1afcaed1413d4c375

SHA256
80ea9dec034576fbe155592f4a16d8372d42a3603ae7e09042c03ce744932d2a

SHA512
4ff8b8e98c0f46b4b81cc36506e2a5f30e015062b4a76948409d271e2b058eb77e61b5a257182b8427873f66182805e93bb637a7b3abffb85e4905e6e63c12ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe

Filesize
468KB

MD5
68c7e9de4a8bb34a0b99cf915212fdae

SHA1
c03d7b7498117ce570d2984775f4650b6e7fda4d

SHA256
1c33d9ab81f5191abea4f652377d6ff615aae03160eb7ee112797479d37d55af

SHA512
12415bbaffc011caf10c7a18bb0ff1cb0af9a25ba77ce3a1307fd5d3f3cbb5b1c3ddc233d054be1bcdff377f11d75b4027dcaa2b6fa9cad69c73830fca6b191c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe

Filesize
468KB

MD5
3028beffa372d35f02bdd65283703b5a

SHA1
546f57b2ccd81c33eeffa6aa2a9fce307ee11836

SHA256
6f0924930792144c648b4e194045b5659ee2ebca59ff560f4d2d41cf5a10aa54

SHA512
b27c720f17c7ce0d19b34aac2da9c15cab4d49139b33ca8836a1f544d5a76c0af655181e57a4a41f45389d06cc849a7ba2aa4b5d55c81238158f531ddeb559a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1335.exe

Filesize
468KB

MD5
3c8190e6f1e6deaf60137aa0a2323617

SHA1
3f0f778c58f5963862787372e571c997945c8ed7

SHA256
b49ce1fd851ac418aa203a5346114cb84aae861865d182441cb7b4356e6e02c9

SHA512
c54e3c8894488990fc3f075f164007cbc70421afac7676a708500c83924a5c578a49a2aaad4acc7839226467674993d6ec976b758cc022ee895084f2d95b4935

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe

Filesize
468KB

MD5
b576a4994c18558ec4dc4f1b7abd8198

SHA1
992926590d6a29d5c5f9806da8e29ea4da2df79f

SHA256
ff42787ce9939bc97119bae340c0d68c0a0f9b5f6aa88baa5526b08f6f194e18

SHA512
7e9b0cabf964658d407bcae64d5c6e9cd41caa9bd3f64ede535d4bd6320766479e8b973b30d072e92a82e057d7885403974cbd9c9d520aa9e1ac4a237124661b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe

Filesize
468KB

MD5
db3ab034339551cfcf53d8a482955473

SHA1
fe7b9f1f97fa2ccd1c777950e10416b8556b2743

SHA256
79ee04b7e12c2d9666d41d569f10df77871611429e47d2b7a50bf7c8df70ebcd

SHA512
056fb9e2ba59344899707466881e1314d371337919f782e015277ce91c816f6fb4e598a8e7baf2cde11ee260bfbd27d1cb821116b1b746eb6d101fdeead087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe

Filesize
468KB

MD5
8bb336ba3ad18e3565d85e523187be91

SHA1
239f05ddc617a2e5c8eb8bce2a543ce0a9011f66

SHA256
48ffc6d4194de90bbc9c5d4ed38482afa82b2e289fa22f1e13fce5f4d4089c4a

SHA512
a29cfa25fdd7c0123971e2738fd3fae2827143c6afa508d244348eaa04408b08153264780c198c820ab383cb6588ede782aea75500becd53faaa07d6ef3d51e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe

Filesize
468KB

MD5
aadfd3b6e6fd88b21b021ec3417c77fe

SHA1
dc91e2f32f22229836851d4c8baff9d340a4fce3

SHA256
96a45e6aac3d579700a95fd945e5015a2d5e07a9ebd4468472d882633e61ba29

SHA512
6ddfc1c61481bcfa8dc2190812b46876908cc7f4997c1af61f6fec67b1ef9b2a8b90dbdff48b2193dc950b887e8a3d1a0d794b9549c7d62ab6895146d7f9ab98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe

Filesize
468KB

MD5
93ea11446e1f22540c16dd08f5a6fe1f

SHA1
e3cd6b3fe44438a23959ae20a44cee3f9700f201

SHA256
7e241c3ecf6530c2ad465e7fab7f40d9a40a923260e0d1acbdf23fb1b2c8728c

SHA512
51cd21a2c9d0c9d2727f10f5ea7297fc083f23a9d797f91047c5a642d6e4bd84a3c896a9d60259bd9c61397de7026ef317d4390dc0d318ac93f33feac1552774

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe

Filesize
468KB

MD5
888bc6c2b49764a4269f7ed490102b51

SHA1
7345ea96f789d4b14b0beed91b5ec948eb967e50

SHA256
fe42862b5b5b7e546f19d9f3bb2fbbae87dda649cf8f733541cc0f30a047c5ef

SHA512
be1a567201eb46bf6d88e82f46547a608e241c8f0830bea727da916db674de69e62fb100823ba196f514f84b601bae461ef1c9d5dc58fe23f641c2bdb2e27581

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26609.exe

Filesize
468KB

MD5
e10a1ba80fa068a341256b33bdd6d6c6

SHA1
f2c9b881b4e22fc532ef427de0383b7a97efce03

SHA256
07c053fcae388f02c56de26a8a45b2ae48726ad0167e286edb234880a0ff7bd1

SHA512
e5b7f6519764494b6842e98817fc0146aa4d07a08576a9b90eb5749065ac43d228b8c3c748bac1cfc2a341278bfe3c96f7436a2993ffa79466bfb2cdeba0e894

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe

Filesize
468KB

MD5
367deab96cd69a3a35d2b276a7add3b9

SHA1
6b919aee11ad989b9ca31512e6817d23e1bef642

SHA256
4cdbce2b45e3c2137d02e0895659cbbcfdbd1c6a05547cd128277eadc64cad0f

SHA512
81db73649ec5865777e01c86e15ae04b0f7916bace4d3c18326798d507c877334855f1d4b6eb3f3d7c62b3665864ddba0fa940a18f805b4121756724c2783af6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe

Filesize
468KB

MD5
94d578c2e61ec2ec71473c344cb2bbe1

SHA1
7e5a5dfc8cc36d6ff7949c1bb1138c36c4abdc57

SHA256
d3aa790eb5751c0aaa824b64122be8cdba190d5eb874c8d90f18a43a65ecdd7a

SHA512
b06be3691daaf2ad37f1b9759d257368eb8fa990ec67f0f890a186c8c153c4d495cb242991fa5a02f06d4936f7c488461ad7ab1205f2926ba5f06ba0c9e6119d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe

Filesize
468KB

MD5
1d7c665902df15f7f6b728f08981edd9

SHA1
f8ea326acd3e969a87d418746ad1a5d97e898262

SHA256
86970ed320a0554cc44bd7a5670748cbd1a96715a153acf3a14ffbe7f6bbbbc5

SHA512
1c2869ec26c0ed9f513c2eb311de9e70c599c50d4d68d235cf10c70e479f6173b08b2e96fcba89dd1b4a04e8ff2abba9b2bf7d638bc2ac02d9357c8101ff7282

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32389.exe

Filesize
468KB

MD5
8327f58431b43713c44e2b7d1104e5d3

SHA1
f4b410b591ecc11b8044cf861cddd291b0d66196

SHA256
85e08adf190c1c74ac9c55f76fc0a05b62c250d306df0a981b64420a5a4004c2

SHA512
05eb382edc7756cf89c7f1928e005f9df172e67fc498647f463250d3f9e1b8c9ee20234eab1b3aeaf24e6a7624d3dacf1f37755fd8ee4ffea592f844e00fa078

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe

Filesize
468KB

MD5
c8830f2ab37ffe592403e950274c98e5

SHA1
1154b7358cf9d3031837eef1355bfebdc9920e84

SHA256
18bbe146c0a7eede53a50b2e8cf317479aaaf6dcf34bac0bfd3f9b201901b744

SHA512
bed647b5be54962612d5d0eff93ae8bc00431f1947ad55f29175a6b5a491b70450426e9a3c76fc478d91de158031615e75345067e1f75a5a53fa0588c29d53ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe

Filesize
468KB

MD5
bd1b0292de1df90d712acff2ecc8db44

SHA1
a418a060b8e35b0c03a34c0aef41fc814ee8b50b

SHA256
d9073947efc0782973aef94f6b0eb9a8f7060662dd9a011afdea6f18c4222e9c

SHA512
20157c3276d5d1f45ab3d9dabb9c49a97bd28b094b03ca0c69bf18acb717e8d0e180a226006f2fb51056a64187a1cbf367973c9e13d5dcffd896c220f19808d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe

Filesize
468KB

MD5
31580797145b71e5e3c16121d76e492d

SHA1
047ded097188af327721b9bccc3eebc4f7c884a7

SHA256
ce72093475de0d3e8762e61a9b3afff7f9fb178812db092e4340809997cd0781

SHA512
5fd9c6ab7b7ff3183c568c419ab5ce3d6a48ad32bf5d8182e8141bd35d17b5c70995add55961d88d2db8b1e7d104aff9455bc304e3bc1cdf2a0204481933a9e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe

Filesize
468KB

MD5
b5200cfa46c0d4849b03260b727cfbc6

SHA1
aa50736bfbadf0bc128f4ef25689037e407e3a45

SHA256
007904432018d75db99ad765a6a413bb79450323cb5742b2c728d05d3889b6a3

SHA512
34969b80e2340eabcbafb6838bce150a718dfdf310ce0eacd604931d2e94433a61f9241934dfe6c74e6b3bfda4c70e5c8947e057bb7d246854278b279f98c8db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe

Filesize
468KB

MD5
4ff58f537f4e92ccba7141a1707182c5

SHA1
16ab77a2769af8fcca0e7f4b0ec783c2f42daa71

SHA256
9b2a2e024fd4a31ff718cc9fc0a483c6ebff145e6c1fef0629146f316ddbe7e1

SHA512
0948f5d18d83755ffe3104c2fcb9b698ab1237c076879b08265f338d8eb96dc8797ea49ff2fc4792cb2aa9cec4d76bd264f6a8112ad0c59deca8d7457b1d5137

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe

Filesize
468KB

MD5
91f611471c5da3e7c748b54c1755403b

SHA1
d2b7124f3457c3e1560d159feab22460ea240b9a

SHA256
d08207f1f9dc8d245215ebd103437d6c7a425e008c41625e3f951dd87edfc1d3

SHA512
71bcba08e4e661a4b9847959c51385bb7e40b1fd22c2cf4d308e06de2476b113372695db8a16a840209fc1dae53007deb6905fae0d7fed4dcf3dd6853e859767

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe

Filesize
468KB

MD5
2a0c9f7d3eab5e620a5655e980bcbd83

SHA1
d1daee7fb0660721fd516638fa6975bdf7693c68

SHA256
01c110c88aa856ac60a4acdb4b53959a451ae2a529076f30c2301e77f2f29a84

SHA512
ea4b49b8a1f1a9ced008de5cc62f2ba9327ca59f83de18b959d8b762ce1fc99e268ad2a9bf2754223dee934ba02fad88ea6b703ccc7ed9e32b1a43fd4d82d53a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe

Filesize
468KB

MD5
f5afbf04ed5682897924699e7f31fadf

SHA1
517717aee03f78d4fa30c729c0e62fcf5acb237e

SHA256
9487966c979496397c8187f0caf8b093c90fec6fb5d23c062fecf1ab0cb27cf3

SHA512
34f4cd82a8a30a649815cf3a8ddf746d272ec383ae8a879c39c3479dbdf3c3cc7d840d525ad7badacc21d3754683126b9ade31109f644db17cbf2fcfa3201fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe

Filesize
468KB

MD5
070eb03b8f0a8cbe72bfccb2d3b69052

SHA1
557f865ff62e81c3b758f0decb2ae8b4628d4ef8

SHA256
bbf034fabbee411cffb426ea0019af4c930fb1dc9cc68ee0b9cd43e03235ee0d

SHA512
53f91c5529d64547edf9707dbb2094cc63d8fc29c1c9c119448f14c5dd5cfcbd0abfbaec0e6da7f714b9ddba6b2c0eed517216e666a191d84918799e8a67c0d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe

Filesize
468KB

MD5
13bc04a6cef0b4257c4390d5c4bb475f

SHA1
868fa53b63f83ef7de531a42bb61333ea353f7fd

SHA256
1a7b5ab48f25e169c798a74bb05c1146357955523871c564664c6a4d6dfa417a

SHA512
b87203150b0eb74434e709b97223ab2dfd55bb025f31348c1979dfb71750e688269c2fe74816f98280a1e4b40adae6422d7ed37196123fda939b463a8486cd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe

Filesize
468KB

MD5
8656f982aad556ece7d8f5783c50d7f7

SHA1
f234a599ecc9d1dee8c0073e7a2a32aa29f11312

SHA256
618a5f7a6dc1703c0e97023444b44fb3b37200ed1a5417529e483721ad2f64ef

SHA512
395aa35b700a3c653efb7a9f48652f90e4b7804c14f86013b6e78151f5187704e5dae3c853e8ca62c9c9650da996e6846e5a374e952f2d1bf9d1cc5fa19e4291

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe

Filesize
468KB

MD5
58cf51bb1452e8284673929408cd6ef6

SHA1
52c99f5ff6270e505f9869985b3515acdb17cb6a

SHA256
8365a30f8905fc9a0e5502b4a64915455bd329c46333230ec9a6d1e40e23b7f9

SHA512
255a82beda508d42e0509851f1c7b70dfe526c0dfeeaf4f62322b49eb8764d6f06b400182ed7cdba7e9daf522acb7a91ec03f6a534bcb34d372a88345d4cfb8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe

Filesize
468KB

MD5
d8a9a95e8154bc23c3d9109ddf45126a

SHA1
6fc70c057b28fad0186e4eb676017adfa841cf8c

SHA256
c29804f256cea0a4d3e3851ee73e475bb98cb618c6749ebc638fe734e7db404a

SHA512
11d2c646131d455b3c2259a5d3f6c96410b799d393d47f723b4adbe33d104452c17fc7a450a0b89aacf9372fe48c1ef7ec91e99347654f7c5986c0a2a3ed1f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe

Filesize
468KB

MD5
98fca8583698996b6dcd3f097d293e29

SHA1
1f381f5e5d4cbffb0990e7835d933e1b7e8ad334

SHA256
158c6b85ea47b5bff4c4b3aea6b5c4443b98b2fa515868c6836b79b6928dc8eb

SHA512
9082d32bd071e4a912eb45f3ae279507dff357b3166f945f114724ba8c523cb050bebb71bd895fcaf1434a0c7afb6ad83a82abed832ecefc98f611661e5dd4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe

Filesize
468KB

MD5
f6942c2618984004e89c2ab47f64031d

SHA1
24c8f7ef125bad329aff805c02853a07b2fad8a4

SHA256
5fea32305663ca9364fe319941ab3d8db8fe69673debcaa680528999902bf13b

SHA512
0360c46985f105e90ade6318b02d81d615a111c0432e9fdf6307908cce8cd164d7dafdc6329e9cee1ca0d2aec1f61dd8fc0d08656b954f34b8fc0ada534cf322

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-780.exe

Filesize
468KB

MD5
0bd776794027a76cf80713569f8fa79d

SHA1
9691c0d84d190e7eeb878961d4d34f9af90e205e

SHA256
8d929245c4fb588ca6272324da60070bbc19b8ef96576951fcabfcfdeed1f23d

SHA512
8a57e12353d2c6c3db466e7fb20a55bfd6ec23798433248a163e17df0f6a4470670cf836765306e83fc61c158fd3de2e4832447cb8540fcf029ca0d4898479a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exe

Filesize
468KB

MD5
f4faaca711cf7d78ffe5d7d48d00504c

SHA1
1a9d72ad88edfdffea2691be3c558da18e3dc873

SHA256
25dba0e20bbb965591d594097576b4a0a5516120293790681b854b5a5b4b5060

SHA512
eaa7ebc0d7752aa07a7337174da3bf5c4bcb9e13f4f53b6d89cf8620c446c1ad374c557b45b2375bc7b1faf69bdeb1741ec85b288ccf35001a3ad22f175bc33b

Download Submit
memory/208-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/312-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/316-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/332-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/372-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/728-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/740-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1056-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1076-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1348-3443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3336-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3360-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3376-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3492-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-2912-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4168-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5072-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5528-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5616-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5700-3607-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5760-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5816-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5832-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7020-3721-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7764-4106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10364-4105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17308-3453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download