4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307

Analysis

max time kernel
71s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe
Size

468KB
MD5

d323418aa23462fb444a0241cbf59d40
SHA1

67d14f233905b48f339181164ba467e548260c5e
SHA256

4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307
SHA512

7375e5d4536ba344bb662796c38496587d13f9ecece619c8632c5372ad7b0bf4cd604c24274d7cf8f9d7890fc746c2b52c2875d8519aa1a86dd35b989ce158ea
SSDEEP

3072:Xrz7ogtxjz8UFbYWPz3yqy8/Eptj7PpgPmHx+lOvElR0AFo1SDl9:XrfoyAUF1PDyqy/BtlElu4o1S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3380	Unicorn-36917.exe
2592	Unicorn-35931.exe
1472	Unicorn-31031.exe
1192	Unicorn-11016.exe
3140	Unicorn-6932.exe
3988	Unicorn-60772.exe
3584	Unicorn-54087.exe
4340	Unicorn-10570.exe
1072	Unicorn-17347.exe
2100	Unicorn-59771.exe
4424	Unicorn-47519.exe
1836	Unicorn-39159.exe
3376	Unicorn-19293.exe
780	Unicorn-38894.exe
5096	Unicorn-24860.exe
928	Unicorn-58785.exe
2876	Unicorn-53118.exe
4204	Unicorn-46341.exe
4564	Unicorn-27958.exe
4372	Unicorn-12490.exe
3356	Unicorn-61691.exe
1312	Unicorn-9782.exe
4820	Unicorn-64384.exe
4932	Unicorn-12582.exe
1032	Unicorn-33657.exe
2928	Unicorn-53258.exe
2256	Unicorn-33657.exe
3036	Unicorn-39325.exe
1748	Unicorn-9153.exe
4140	Unicorn-62459.exe
4452	Unicorn-13350.exe
1652	Unicorn-33679.exe
2204	Unicorn-9729.exe
3152	Unicorn-29595.exe
396	Unicorn-17077.exe
1964	Unicorn-56429.exe
4080	Unicorn-48837.exe
336	Unicorn-10497.exe
3372	Unicorn-7612.exe
2604	Unicorn-7612.exe
4048	Unicorn-22003.exe
2576	Unicorn-41053.exe
2816	Unicorn-41053.exe
1592	Unicorn-21187.exe
2684	Unicorn-60711.exe
4168	Unicorn-4104.exe
3844	Unicorn-55343.exe
4572	Unicorn-61473.exe
220	Unicorn-47175.exe
3544	Unicorn-34730.exe
2124	Unicorn-12827.exe
4680	Unicorn-64596.exe
4540	Unicorn-16165.exe
5080	Unicorn-33247.exe
3040	Unicorn-24836.exe
1136	Unicorn-18970.exe
1128	Unicorn-6434.exe
4884	Unicorn-59719.exe
2460	Unicorn-20559.exe
2000	Unicorn-14694.exe
2792	Unicorn-43191.exe
3888	Unicorn-23325.exe
1672	Unicorn-47275.exe
1664	Unicorn-54052.exe

Program crash 41 IoCs

pid	pid_target	Process	procid_target
1452	780	WerFault.exe	107
2856	4424	WerFault.exe	104
4772	3376	WerFault.exe	106
4848	1836	WerFault.exe	105
5268	4452	WerFault.exe	136
6576	5236	WerFault.exe	176
6672	5156	WerFault.exe	173
6660	3888	WerFault.exe	166
6512	1072	WerFault.exe	102
5724	5928	WerFault.exe	193
7576	6068	WerFault.exe	197
8112	5252	WerFault.exe	228
7760	2124	WerFault.exe	156
8224	4476	WerFault.exe	170
7728	6060	WerFault.exe	196
5444	5808	WerFault.exe	192
7608	5732	WerFault.exe	188
9588	6132	WerFault.exe	202
9992	2256	WerFault.exe	124
10692	5180	WerFault.exe	232
12764	7380	WerFault.exe	371
13308	5176	WerFault.exe	207
3300	7956	WerFault.exe	337
6332	8104	WerFault.exe	341
5632	7136	WerFault.exe	257
1684	6340	WerFault.exe	433
14180	5240	WerFault.exe	304
9136	5204	WerFault.exe	286
14532	7216	WerFault.exe	312
1508	9552	WerFault.exe	461
7380	3296	WerFault.exe	407
15732	8448	WerFault.exe	419
7888	2896	WerFault.exe
13452	7892	WerFault.exe	352
16112	7912	WerFault.exe	443
15608	10168	WerFault.exe
10792	3924	WerFault.exe	227
3300	7060	WerFault.exe	279
9744	2684	WerFault.exe	150
11768	9664	WerFault.exe	514
17120	1652	Process not Found	137

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24083.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe
3380	Unicorn-36917.exe
2592	Unicorn-35931.exe
1472	Unicorn-31031.exe
1192	Unicorn-11016.exe
3584	Unicorn-54087.exe
3140	Unicorn-6932.exe
3988	Unicorn-60772.exe
4340	Unicorn-10570.exe
1072	Unicorn-17347.exe
5096	Unicorn-24860.exe
4424	Unicorn-47519.exe
2100	Unicorn-59771.exe
3376	Unicorn-19293.exe
1836	Unicorn-39159.exe
780	Unicorn-38894.exe
928	Unicorn-58785.exe
2876	Unicorn-53118.exe
4204	Unicorn-46341.exe
4564	Unicorn-27958.exe
4372	Unicorn-12490.exe
3356	Unicorn-61691.exe
2928	Unicorn-53258.exe
4820	Unicorn-64384.exe
1032	Unicorn-33657.exe
4932	Unicorn-12582.exe
1312	Unicorn-9782.exe
2256	Unicorn-33657.exe
3036	Unicorn-39325.exe
1748	Unicorn-9153.exe
4140	Unicorn-62459.exe
4452	Unicorn-13350.exe
2204	Unicorn-9729.exe
1652	Unicorn-33679.exe
396	Unicorn-17077.exe
1964	Unicorn-56429.exe
4080	Unicorn-48837.exe
336	Unicorn-10497.exe
3372	Unicorn-7612.exe
4048	Unicorn-22003.exe
2816	Unicorn-41053.exe
1592	Unicorn-21187.exe
2576	Unicorn-41053.exe
4168	Unicorn-4104.exe
2684	Unicorn-60711.exe
4572	Unicorn-61473.exe
3844	Unicorn-55343.exe
220	Unicorn-47175.exe
2124	Unicorn-12827.exe
3544	Unicorn-34730.exe
4540	Unicorn-16165.exe
1136	Unicorn-18970.exe
5080	Unicorn-33247.exe
4680	Unicorn-64596.exe
3040	Unicorn-24836.exe
1128	Unicorn-6434.exe
2000	Unicorn-14694.exe
2460	Unicorn-20559.exe
4884	Unicorn-59719.exe
1672	Unicorn-47275.exe
2792	Unicorn-43191.exe
3888	Unicorn-23325.exe
1664	Unicorn-54052.exe
4476	Unicorn-64987.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3380	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	89
PID 4824 wrote to memory of 3380	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	89
PID 4824 wrote to memory of 3380	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	89
PID 3380 wrote to memory of 2592	3380	Unicorn-36917.exe	91
PID 3380 wrote to memory of 2592	3380	Unicorn-36917.exe	91
PID 3380 wrote to memory of 2592	3380	Unicorn-36917.exe	91
PID 4824 wrote to memory of 1472	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	92
PID 4824 wrote to memory of 1472	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	92
PID 4824 wrote to memory of 1472	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	92
PID 2592 wrote to memory of 1192	2592	Unicorn-35931.exe	93
PID 2592 wrote to memory of 1192	2592	Unicorn-35931.exe	93
PID 2592 wrote to memory of 1192	2592	Unicorn-35931.exe	93
PID 1472 wrote to memory of 3140	1472	Unicorn-31031.exe	94
PID 1472 wrote to memory of 3140	1472	Unicorn-31031.exe	94
PID 1472 wrote to memory of 3140	1472	Unicorn-31031.exe	94
PID 3380 wrote to memory of 3988	3380	Unicorn-36917.exe	95
PID 3380 wrote to memory of 3988	3380	Unicorn-36917.exe	95
PID 3380 wrote to memory of 3988	3380	Unicorn-36917.exe	95
PID 4824 wrote to memory of 3584	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	96
PID 4824 wrote to memory of 3584	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	96
PID 4824 wrote to memory of 3584	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	96
PID 1192 wrote to memory of 4340	1192	Unicorn-11016.exe	101
PID 1192 wrote to memory of 4340	1192	Unicorn-11016.exe	101
PID 1192 wrote to memory of 4340	1192	Unicorn-11016.exe	101
PID 2592 wrote to memory of 1072	2592	Unicorn-35931.exe	102
PID 2592 wrote to memory of 1072	2592	Unicorn-35931.exe	102
PID 2592 wrote to memory of 1072	2592	Unicorn-35931.exe	102
PID 3584 wrote to memory of 2100	3584	Unicorn-54087.exe	103
PID 3584 wrote to memory of 2100	3584	Unicorn-54087.exe	103
PID 3584 wrote to memory of 2100	3584	Unicorn-54087.exe	103
PID 3140 wrote to memory of 4424	3140	Unicorn-6932.exe	104
PID 3140 wrote to memory of 4424	3140	Unicorn-6932.exe	104
PID 3140 wrote to memory of 4424	3140	Unicorn-6932.exe	104
PID 3988 wrote to memory of 1836	3988	Unicorn-60772.exe	105
PID 3988 wrote to memory of 1836	3988	Unicorn-60772.exe	105
PID 3988 wrote to memory of 1836	3988	Unicorn-60772.exe	105
PID 1472 wrote to memory of 3376	1472	Unicorn-31031.exe	106
PID 1472 wrote to memory of 3376	1472	Unicorn-31031.exe	106
PID 1472 wrote to memory of 3376	1472	Unicorn-31031.exe	106
PID 4824 wrote to memory of 780	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	107
PID 4824 wrote to memory of 780	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	107
PID 4824 wrote to memory of 780	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	107
PID 3380 wrote to memory of 5096	3380	Unicorn-36917.exe	108
PID 3380 wrote to memory of 5096	3380	Unicorn-36917.exe	108
PID 3380 wrote to memory of 5096	3380	Unicorn-36917.exe	108
PID 4340 wrote to memory of 928	4340	Unicorn-10570.exe	110
PID 4340 wrote to memory of 928	4340	Unicorn-10570.exe	110
PID 4340 wrote to memory of 928	4340	Unicorn-10570.exe	110
PID 1192 wrote to memory of 2876	1192	Unicorn-11016.exe	111
PID 1192 wrote to memory of 2876	1192	Unicorn-11016.exe	111
PID 1192 wrote to memory of 2876	1192	Unicorn-11016.exe	111
PID 1072 wrote to memory of 4204	1072	Unicorn-17347.exe	112
PID 1072 wrote to memory of 4204	1072	Unicorn-17347.exe	112
PID 1072 wrote to memory of 4204	1072	Unicorn-17347.exe	112
PID 2592 wrote to memory of 4564	2592	Unicorn-35931.exe	113
PID 2592 wrote to memory of 4564	2592	Unicorn-35931.exe	113
PID 2592 wrote to memory of 4564	2592	Unicorn-35931.exe	113
PID 5096 wrote to memory of 4372	5096	Unicorn-24860.exe	115
PID 5096 wrote to memory of 4372	5096	Unicorn-24860.exe	115
PID 5096 wrote to memory of 4372	5096	Unicorn-24860.exe	115
PID 2100 wrote to memory of 3356	2100	Unicorn-59771.exe	117
PID 2100 wrote to memory of 3356	2100	Unicorn-59771.exe	117
PID 2100 wrote to memory of 3356	2100	Unicorn-59771.exe	117
PID 4824 wrote to memory of 1312	4824	4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe	118

C:\Users\Admin\AppData\Local\Temp\4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe
"C:\Users\Admin\AppData\Local\Temp\4872fcb972d1a8ea61cb8886cd517984f475b621d8595b7d53af4b761fd7c307N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61473.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24463.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        10⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18986.exe
        11⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        12⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        12⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        10⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        11⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        11⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        10⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        9⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        10⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        10⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        10⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        10⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        9⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        10⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        10⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        9⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        10⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7833.exe
        11⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 636
        11⤵
        Program crash
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
        10⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        10⤵
        
        PID:16104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 680
        10⤵
        Program crash
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47026.exe
        9⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        10⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        10⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        9⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33137.exe
        9⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        9⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        9⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
        8⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15885.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        9⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        10⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        11⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        10⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 660
        10⤵
        Program crash
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        9⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        10⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        9⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        8⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        9⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 652
        9⤵
        Program crash
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2431.exe
        8⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29271.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4262.exe
        7⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        9⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        10⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        11⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        9⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        9⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        8⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        7⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
        9⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        10⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        9⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        9⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exe
        9⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        9⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        9⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39054.exe
        7⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        7⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        7⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        7⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55875.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        6⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40005.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34525.exe
        9⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        10⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        11⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        11⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        9⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        10⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        10⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        9⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        9⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        8⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        9⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        9⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
        9⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        9⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        8⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        9⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        9⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        8⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        9⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        9⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45773.exe
        8⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        7⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        7⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        7⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        6⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exe
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        6⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 720
        6⤵
        Program crash
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        7⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exe
        5⤵
        
        PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64102.exe
        8⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        8⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        8⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        8⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        7⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 720
        7⤵
        Program crash
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27844.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        9⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        7⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        6⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        8⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 628
        8⤵
        Program crash
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        9⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        8⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        6⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        9⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        9⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        8⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        7⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48674.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
        7⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        8⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe
        7⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        6⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        6⤵
        
        PID:7772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 768
        5⤵
        Program crash
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
        5⤵
        Executes dropped EXE
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        8⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        8⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        8⤵
        
        PID:12676
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 748
        6⤵
        Program crash
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        7⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        6⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43191.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
        9⤵
        
        PID:15472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9664 -s 752
        9⤵
        Program crash
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        8⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        8⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        8⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        7⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        7⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        7⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        7⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 604
        7⤵
        Program crash
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
        5⤵
        
        PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64987.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        6⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12239.exe
        7⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        6⤵
        
        PID:1068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 660
        5⤵
        Program crash
        
        PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        6⤵
        
        PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
      4⤵
      PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55306.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57471.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
      4⤵
      PID:8364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 636
        5⤵
        Program crash
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        9⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exe
        9⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        8⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        9⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        8⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4160.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        8⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        8⤵
        
        PID:14836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 636
        7⤵
        Program crash
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64102.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6951.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        7⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        7⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        6⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        5⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        7⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        6⤵
        
        PID:15320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 660
        5⤵
        Program crash
        
        PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52423.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        7⤵
        
        PID:8384
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 636
        6⤵
        Program crash
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        6⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57755.exe
        5⤵
        
        PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        6⤵
        
        PID:13216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 716
        6⤵
        Program crash
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        6⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
        5⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5304.exe
      4⤵
      PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8104 -s 624
        5⤵
        Program crash
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
      4⤵
      PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        5⤵
        
        PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
      4⤵
      PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
      4⤵
      PID:8680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54159.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19644.exe
        7⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        7⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        5⤵
        
        PID:5236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 632
        6⤵
        Program crash
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        6⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        7⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        6⤵
        
        PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21124.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        6⤵
        
        PID:15420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        5⤵
        
        PID:7380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7380 -s 628
        6⤵
        Program crash
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34341.exe
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        5⤵
        
        PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        5⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        6⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40281.exe
      4⤵
      PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
      4⤵
      PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
      4⤵
      PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
      4⤵
      PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe
        9⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
        9⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12239.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        8⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42748.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        7⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        7⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9552 -s 648
        7⤵
        Program crash
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56428.exe
        6⤵
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
        7⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        7⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        7⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        6⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        5⤵
        
        PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15866.exe
        6⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exe
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
      4⤵
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
      4⤵
      PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
      4⤵
      PID:9040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        6⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42749.exe
        5⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        6⤵
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        5⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        6⤵
        
        PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
      4⤵
      PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        5⤵
        
        PID:9484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
      4⤵
      PID:12660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
      4⤵
      PID:16000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 688
      4⤵
      Program crash
      PID:9744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
    3⤵
    PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
      4⤵
      PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        5⤵
        
        PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
      4⤵
      PID:9560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
      4⤵
      PID:12772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
      4⤵
      PID:15648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
    3⤵
    PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      4⤵
      PID:11168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
    3⤵
    PID:9732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
    3⤵
    PID:13520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exe
    3⤵
    PID:15940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 720
        5⤵
        Program crash
        
        PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        5⤵
        Executes dropped EXE
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        9⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        9⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        9⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        9⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 724
        8⤵
        Program crash
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58749.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        8⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        7⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        7⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65530.exe
        6⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        8⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-297.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        7⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
        7⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        7⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        5⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        6⤵
        
        PID:15188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe
        5⤵
        
        PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24463.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
        7⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        6⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        7⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
        6⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        6⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        7⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        6⤵
        
        PID:4692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 652
        6⤵
        Program crash
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        5⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        6⤵
        
        PID:11880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8448 -s 656
        6⤵
        Program crash
        
        PID:15732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        6⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        7⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        6⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12689.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        5⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        6⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        6⤵
        
        PID:1828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 656
        5⤵
        Program crash
        
        PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        5⤵
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
      4⤵
      PID:12596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 632
      4⤵
      Program crash
      PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        7⤵
        
        PID:15836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 752
        6⤵
        Program crash
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        5⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        6⤵
        
        PID:13456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
      4⤵
      PID:6068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 604
        5⤵
        Program crash
        
        PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
      4⤵
      PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        5⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        6⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
      4⤵
      PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        5⤵
        
        PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
      4⤵
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
      4⤵
      PID:15656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        6⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        7⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 664
        7⤵
        Program crash
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        6⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        6⤵
        
        PID:7080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 636
        5⤵
        Program crash
        
        PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
      4⤵
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        5⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        6⤵
        
        PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
        5⤵
        
        PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        5⤵
        
        PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
    3⤵
    PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
      4⤵
      PID:10168
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10168 -s 636
        5⤵
        Program crash
        
        PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
      4⤵
      PID:9032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21132.exe
    3⤵
    PID:9396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
    3⤵
    PID:12700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    3⤵
    PID:15856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
    3⤵
    PID:7144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        6⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 632
        7⤵
        Program crash
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        8⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe
        6⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12239.exe
        8⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        8⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        6⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2431.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4429.exe
        8⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        8⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:10600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
        6⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        5⤵
        
        PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
        9⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        9⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 652
        8⤵
        Program crash
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        7⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        6⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        7⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        7⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
        6⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        7⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        6⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        5⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53770.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65172.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        5⤵
        
        PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        6⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13623.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8300.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        5⤵
        
        PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18986.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        6⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        5⤵
        
        PID:680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
      4⤵
      PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        7⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        7⤵
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        6⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        6⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        7⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        6⤵
        
        PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        6⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        7⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        6⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe
        5⤵
        
        PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
      4⤵
      PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        5⤵
        
        PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29268.exe
      4⤵
      PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
      4⤵
      PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
      4⤵
      PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
      4⤵
      PID:10124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
      4⤵
      PID:5928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 624
        5⤵
        Program crash
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        5⤵
        
        PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
      4⤵
      PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        5⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        5⤵
        
        PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
    3⤵
    PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
        5⤵
        
        PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
      4⤵
      PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
      4⤵
      PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38966.exe
      4⤵
      PID:16200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
    3⤵
    PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34008.exe
      4⤵
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
      4⤵
      PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
    3⤵
    PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
      4⤵
      PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
      4⤵
      PID:532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
    3⤵
    PID:12640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
    3⤵
    PID:16084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
    3⤵
    PID:7112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 552
    3⤵
    - Program crash
    PID:1452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        7⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        6⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        6⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
      4⤵
      PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
        5⤵
        
        PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
        6⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        5⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        6⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59906.exe
      4⤵
      PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        5⤵
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        5⤵
        
        PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
      4⤵
      PID:13600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
      4⤵
      PID:16248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
    3⤵
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        5⤵
        
        PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
      4⤵
      PID:13184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exe
      4⤵
      PID:7780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
    3⤵
    PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      4⤵
      PID:5620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7892 -s 652
      4⤵
      Program crash
      PID:13452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
    3⤵
    PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
      4⤵
      PID:10696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
    3⤵
    PID:13480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
    3⤵
    PID:16024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
    3⤵
    PID:7188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
    3⤵
    PID:5252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 604
      4⤵
      Program crash
      PID:8112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
  2⤵
  PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
    3⤵
    PID:7504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 752
    3⤵
    - Program crash
    PID:5632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4890.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4890.exe
  2⤵
  PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
    3⤵
    PID:9576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
  2⤵
  PID:6036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
  2⤵
  PID:6464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
  2⤵
  PID:14224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 780 -ip 780
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1836 -ip 1836
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4424 -ip 4424
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3376 -ip 3376
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4452 -ip 4452
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1072 -ip 1072
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3888 -ip 3888
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5236 -ip 5236
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5156 -ip 5156
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5168 -ip 5168
1⤵
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2460 -ip 2460
1⤵
PID:6188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4884 -ip 4884
1⤵
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4372 -ip 4372
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5928 -ip 5928
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6068 -ip 6068
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5252 -ip 5252
1⤵
PID:7968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2124 -ip 2124
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4476 -ip 4476
1⤵
PID:7088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5452 -ip 5452
1⤵
PID:6360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5428 -ip 5428
1⤵
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4680 -ip 4680
1⤵
PID:7508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1664 -ip 1664
1⤵
PID:7600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2576 -ip 2576
1⤵
PID:8148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 336 -ip 336
1⤵
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4048 -ip 4048
1⤵
PID:8216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1964 -ip 1964
1⤵
PID:8388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4140 -ip 4140
1⤵
PID:8488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4564 -ip 4564
1⤵
PID:8680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6060 -ip 6060
1⤵
PID:8992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5808 -ip 5808
1⤵
PID:9056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5732 -ip 5732
1⤵
PID:8136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6132 -ip 6132
1⤵
PID:9108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5232 -ip 5232
1⤵
PID:8112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6032 -ip 6032
1⤵
PID:9248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2256 -ip 2256
1⤵
PID:9636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4080 -ip 4080
1⤵
PID:9724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5180 -ip 5180
1⤵
PID:9900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3924 -ip 3924
1⤵
PID:9468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6204 -ip 6204
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7456 -ip 7456
1⤵
PID:7448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6948 -ip 6948
1⤵
PID:10368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6760 -ip 6760
1⤵
PID:10376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5144 -ip 5144
1⤵
PID:10524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6240 -ip 6240
1⤵
PID:10764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4540 -ip 4540
1⤵
PID:10744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6348 -ip 6348
1⤵
PID:11200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7708 -ip 7708
1⤵
PID:10560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 7380 -ip 7380
1⤵
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 8140 -ip 8140
1⤵
PID:10544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5952 -ip 5952
1⤵
PID:10904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5176 -ip 5176
1⤵
PID:11324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5704 -ip 5704
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7160 -ip 7160
1⤵
PID:12388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 9028 -ip 9028
1⤵
PID:12868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6748 -ip 6748
1⤵
PID:13096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3040 -ip 3040
1⤵
PID:13104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3844 -ip 3844
1⤵
PID:13180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5292 -ip 5292
1⤵
PID:13188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5832 -ip 5832
1⤵
PID:13216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6084 -ip 6084
1⤵
PID:13244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3376 -ip 3376
1⤵
PID:13252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3544 -ip 3544
1⤵
PID:13264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2816 -ip 2816
1⤵
PID:6240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5436 -ip 5436
1⤵
PID:11692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4572 -ip 4572
1⤵
PID:11704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5520 -ip 5520
1⤵
PID:11268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4168 -ip 4168
1⤵
PID:12376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5536 -ip 5536
1⤵
PID:12356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1672 -ip 1672
1⤵
PID:12680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6736 -ip 6736
1⤵
PID:8756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6796 -ip 6796
1⤵
PID:12392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5364 -ip 5364
1⤵
PID:10548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6208 -ip 6208
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5744 -ip 5744
1⤵
PID:13192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6156 -ip 6156
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5400 -ip 5400
1⤵
PID:12412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 7308 -ip 7308
1⤵
PID:11412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5140 -ip 5140
1⤵
PID:11868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1836 -ip 1836
1⤵
PID:12076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 7484 -ip 7484
1⤵
PID:13836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6248 -ip 6248
1⤵
PID:15048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 8364 -ip 8364
1⤵
PID:15084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 8904 -ip 8904
1⤵
PID:15104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 8544 -ip 8544
1⤵
PID:15132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5152 -ip 5152
1⤵
PID:15152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6984 -ip 6984
1⤵
PID:15160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6652 -ip 6652
1⤵
PID:15280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6700 -ip 6700
1⤵
PID:13704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6640 -ip 6640
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3772 -ip 3772
1⤵
PID:13772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5352 -ip 5352
1⤵
PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5248 -ip 5248
1⤵
PID:13372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6848 -ip 6848
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6272 -ip 6272
1⤵
PID:14016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4372 -ip 4372
1⤵
PID:13188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 7144 -ip 7144
1⤵
PID:15244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 7132 -ip 7132
1⤵
PID:14444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6840 -ip 6840
1⤵
PID:14348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 8104 -ip 8104
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7832 -ip 7832
1⤵
PID:11900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7956 -ip 7956
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6660 -ip 6660
1⤵
PID:13188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 7388 -ip 7388
1⤵
PID:14468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5160 -ip 5160
1⤵
PID:13432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 8076 -ip 8076
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7876 -ip 7876
1⤵
PID:14004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 7816 -ip 7816
1⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6880 -ip 6880
1⤵
PID:7516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 8324 -ip 8324
1⤵
PID:6980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 7256 -ip 7256
1⤵
PID:13076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7764 -ip 7764
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 7776 -ip 7776
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6512 -ip 6512
1⤵
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6864 -ip 6864
1⤵
PID:12284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4204 -ip 4204
1⤵
PID:14488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3356 -ip 3356
1⤵
PID:15420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5416 -ip 5416
1⤵
PID:15672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3372 -ip 3372
1⤵
PID:15692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 7684 -ip 7684
1⤵
PID:15756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4820 -ip 4820
1⤵
PID:15972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8472 -ip 8472
1⤵
PID:16168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5964 -ip 5964
1⤵
PID:16176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 7564 -ip 7564
1⤵
PID:16360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 8896 -ip 8896
1⤵
PID:15400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5760 -ip 5760
1⤵
PID:15396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5728 -ip 5728
1⤵
PID:15948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6120 -ip 6120
1⤵
PID:6924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5716 -ip 5716
1⤵
PID:6448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 8296 -ip 8296
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 7132 -ip 7132
1⤵
PID:15076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 220 -ip 220
1⤵
PID:7832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6076 -ip 6076
1⤵
PID:14468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 9744 -ip 9744
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 8652 -ip 8652
1⤵
PID:16020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 10168 -ip 10168
1⤵
PID:8456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 1160 -ip 1160
1⤵
PID:8912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3140 -ip 3140
1⤵
PID:15800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 9232 -ip 9232
1⤵
PID:15852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 8944 -ip 8944
1⤵
PID:13252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 7912 -ip 7912
1⤵
PID:15916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 8304 -ip 8304
1⤵
PID:16052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 7656 -ip 7656
1⤵
PID:15396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7588 -ip 7588
1⤵
PID:11276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6072 -ip 6072
1⤵
PID:16360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 8428 -ip 8428
1⤵
PID:7564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8968 -ip 8968
1⤵
PID:16364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3296 -ip 3296
1⤵
PID:14496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 8448 -ip 8448
1⤵
PID:15376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 2896 -ip 2896
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 9552 -ip 9552
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 7472 -ip 7472
1⤵
PID:15824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 6340 -ip 6340
1⤵
PID:13252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7152 -ip 7152
1⤵
PID:15672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 7216 -ip 7216
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5240 -ip 5240
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7648 -ip 7648
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 7136 -ip 7136
1⤵
PID:13176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 7040 -ip 7040
1⤵
PID:8432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5204 -ip 5204
1⤵
PID:13308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5080 -ip 5080
1⤵
PID:13660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 11152 -ip 11152
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2876 -ip 2876
1⤵
PID:14252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 9204 -ip 9204
1⤵
PID:8856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7732 -ip 7732
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7940 -ip 7940
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4504 -ip 4504
1⤵
PID:15852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 8308 -ip 8308
1⤵
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 9664 -ip 9664
1⤵
PID:6784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4824 -ip 4824
1⤵
PID:9748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe

Filesize
468KB

MD5
97bc3e640003b776bfb8491b016b8f48

SHA1
98cb8a4cd8b27db66a6f5b0f0c887b2af86fa43c

SHA256
23267dc11505c479ed889eda6076231ac6fc8ebc649c2484282f69db8b721eec

SHA512
7aa7322e8ec58a76d7cb0b0ba451fcbc7470f152ead6f7dab519dcd038c4d8835475a396280225ea9918d2bacb3d0e846a828421176a16d155c04da87ce8923b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe

Filesize
468KB

MD5
c26a358de4625587ba39e07318663da7

SHA1
962c7bdb0531afc9038643f65d4fd22167483a8b

SHA256
60cece18fb31b09bf8ef0ab9f83002a5cf46e47f6d77ce6704fe485b92685ae9

SHA512
e5e6ad4f06b38cc348c580107887c59b13d7652ac9afca297846cbc684fab9960c88d0f18a1eec03fd359859a50c3288d4134d197db825bb763fb3c567b13b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe

Filesize
468KB

MD5
4275244486f9a06c0ab92f0837327fe5

SHA1
43d54ba899f570fa09c8cc7287e9757a4e2e7603

SHA256
11c3bff895ed3beeec6a32e98441b9beb2d71b47b98084ce25c62aba29940fb3

SHA512
098ace51e7bceeb140270f8457f4a39f77cc3212930670f895fa2c2499d72d67339646c7811f7b30a53c04c953245c1895f5a16f2eb7ce9194ce3e52756533f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe

Filesize
468KB

MD5
02ca55a0a9a8deb05e891b02907a5708

SHA1
2ca7592ebb2ef40bfdf7a817851c6cf1cc9073ad

SHA256
2f04a169b477c51339c6f9d58310b3a86321f72c8502b653f96aa10b662dee8b

SHA512
29a03f36fecc43cb018104d420aaca68da7abddac5a8ef028ddf85321d64d7aaac1bca195e26660cfc0f4f2f67fa3a712cc5084a6a3df0cd9326b4c504d489a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe

Filesize
468KB

MD5
0d8061c569d3b182d61d304899191b9e

SHA1
0d8d1d93d7b080a8ef63525a2bb5e10cdc0bff06

SHA256
ba1f4d1acbd875d0484ce8a09834813b28753cc28e60f9304be415b2b2c1697a

SHA512
6cb3e25ff570822dfc1bd2e5dbe355e0555266c3816e480ce9bd42adf7d53fd82b062adb279192b58607edbda49114a48d5ee5e685d4979f0e3aae8eeae05d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe

Filesize
468KB

MD5
88bc069771b238515bb8a19b6adc3a24

SHA1
5e1520772890cebaff1f2f61f6631d1a05831e8a

SHA256
8dbc5c829e1cda7206f3ba2d123f733f300b93a74eed8039c332c9557245f4f9

SHA512
fa2ff5efae80d919a2594330edc17dca966771586c3e8fbde1d3b0f2e70297adfdad0ae0632d0ab69379bf54f4306f5d1b2010c6901f12968e641b65732e130f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exe

Filesize
468KB

MD5
ed8ddb8eb6002e84c3d7e586b642f472

SHA1
22cb0b74640b3131d2a14b81137029eb63a7970e

SHA256
a6f55bdc5f3a52b30c5ed62ea279fb01f77567b22a5e192c6044a87ef122cdfc

SHA512
1d23cb07b3c09bb151fbe6ea350f4797799dfe410e2b404a5e09c3e8cfe3a9a4e3d81ef186a33ac77d81b572d8190838827efa6a7529166060c34056b21766fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe

Filesize
468KB

MD5
55398837678d387ba63ca0fee02762b9

SHA1
a6889d403994454031e65563cfba87930292f987

SHA256
7e5d1d1c43ec6a6999e2cdcb894f40a9f67b6396e17012c70843b6df26381db2

SHA512
13721981f050729cd0127455f0b5db8e1dacbaf4d1f7ef462f28575ead9f08db52e6b9d9cf1135d72ebbabc38b042264a54701b5330102ff3a92af6754e574f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe

Filesize
468KB

MD5
f39d3502b33d8ac975bcc531ac77460d

SHA1
961cc57658ef5ddba87cda171a8665e4e8577bf6

SHA256
eade0f6097bf29d05cb85f74e41d119a9256282bec7bb0817be0c40671448b85

SHA512
8bc0a08bb5758071335e6d77342872cfa63b84479a67efd12bbbb5e6dfb3be090dc912e44afa79571556bcbf686eabe04d5ae4af0748a4af5ba6965682548fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe

Filesize
468KB

MD5
1a51621ef8b86b39a48ef48091ae18c9

SHA1
583615a76dcc9c23b811e8a68fb8684be2813844

SHA256
20b0b29b6d9a680004475d261baff32d4cc51bec2a4d860ef02d61e17c263c5a

SHA512
707650a530bb545742bbdab58cc84a1bd44fdac6661c1df2b4c1577fdf4e152d87eabcb49e156cd989d918b8c1d042c7b5e4b269e8e142e1a9f3d2f84049295d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe

Filesize
468KB

MD5
0eec350b7134a7abd080a206e4fb4597

SHA1
507027cc7da09e6b2edee9c25fb78f1e70101769

SHA256
302955126fa951130900150d91ca05954d9fce542d8bbfe85931a159de2a1a6c

SHA512
4dbc4a9697dd29f99a58c13ef2765488d27f01ea9956bf1992d439664a7fa80ada765211d202d646d49cc63fcc3d0fc765e47933e954cd448fefc8e974aec7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe

Filesize
468KB

MD5
4136777a50a961a65dea11d5ac899a9a

SHA1
806712794d6aeb6906b6546de34419e1002e8d98

SHA256
10ec57df1085de68c97715de3d59433ebd398d1136d77ecc929db95b3e1bd152

SHA512
f92e7cc05d8e37ecb592334c95402aebe291d20361570606bcadb78235e0698257a370ecc3e6f7b06daf9c8a671d84459f2dc20d314f3bb552c84020d056422e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe

Filesize
468KB

MD5
6731a279331932f35b26a0997ab14b3c

SHA1
f71530db71b49a605c5ef62e3b8df3d0b66ebca4

SHA256
5be633688e319e427cbfa1583d86bd437819e31103508bd5114de7163671b897

SHA512
15bc3ca2237ab852a94c36f65d5d66b242481dda6485e6e97a62b5518a927bae64e21d519766d03adb4627c4cb1118bfb2c794e74756d010534cfc828152c736

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe

Filesize
468KB

MD5
01111c30a9db71e697946511ac2930fb

SHA1
b55045cd4e258345ada79fec2b98d5755376b765

SHA256
2d84feec6b171d7b0eebaf732d3004c2ef9ca95775cafb5c5775fbc3abc80d86

SHA512
08e88a6e6f4f96dc61786a89db01ac08a33b53fab6eb1f5ec8d58bc44fb7470065dcb4ae112115dd0e7fdd03ebe64509e652256a82a193e8c1cb424389048f18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe

Filesize
468KB

MD5
8131dc8997cfda569c28574d41524d48

SHA1
a9aeb5dfa2766397a3bf28309d2e611c775f1546

SHA256
f700c120180ab00ad47376a5d61c7476c7ba02a133a2b5a4ead893c7467ff380

SHA512
b9f6827a89b267782d83aef717fc9c4d804232d0ec04b6027655048698b5b3937b2e5730a088b7329acc8dc34c41bc67c369c06788af860f5450eb26324402b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe

Filesize
468KB

MD5
c05a27c8853e02acbcf1f8486e80006c

SHA1
fcb42199f8524c818a56c2bd8256731e77c503c3

SHA256
3c28db161b48667193c1c11818a01285829a3411ad1d8b253d485482b39ff621

SHA512
41342be78ab718b1e4fae632a970887c9bba4285dd46ffd533fc89d1db7dd7f7dbcd0af97497abe7af2eb73904e4110d6a58d907b010f0e41c747f74b1d61b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe

Filesize
468KB

MD5
5987cab0169be359c0d2598666502bb2

SHA1
7e684f6f2251cf3aaf96055088450d1731b6dd54

SHA256
092fb949b7ac70f3f3f723a826c1fef9e41a90977b286c6b442d93d567353352

SHA512
435d0faa57cf4a4f1c8ac1d41670c8bac32eb775abfa6f9ad9ad7d1d7b1287d8acdbd29d6c17754e488fccefb2971a53f3e62acdaa9beb64e5135afd16abe9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe

Filesize
468KB

MD5
5248b95e6218650ad5c9c30f355ff7f1

SHA1
5c4bc01bec7c8fc50307a2e98dd660db6ef1ba69

SHA256
5222267e0d3226eef0ceb6cae38ca8a8c6dbbe17b4b0a8cae068bac9ae1c8e8b

SHA512
09834e0cb88f1531a9b1399a273e99d39bf95482ac0fa9a574850b3290f4cd803842b5926e8241bb51652438b5218e77ca7acf7fccdaa844265f6d49e7aefc8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe

Filesize
468KB

MD5
0899495107a5e3215c1dff2ccce9dcfd

SHA1
5be2c9bcbd0c73be0733e81a4a49626a1234ea32

SHA256
21060f9fd6ddbefcb19918a0a8a5a529b4eef112a1d0aa873190c8d7a8c9eed5

SHA512
55706d334db27aee1a6150227350d5637e2be9dc548a18c472a77849afa2066b1b345fd663e96f145a23d6b58755a6fc45258a1b4b80095795f16dcd3339991a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe

Filesize
468KB

MD5
fc769764e3f5541832809fb19c26c55e

SHA1
2991d4da8ee871f32cfc3d27d58e6c68592a2c14

SHA256
2b326d821512102c44637c059c5f00deb602bbf56d7d9423c2912ff0e65ca1a4

SHA512
aba1bce4d20180d1ca889b7fb71400efd7916bb44f7bb46e4631aea49d9604d9c51ecb2b3d3b29a449fd252959273f23dde61c8c380e779f15af2518862f3520

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe

Filesize
468KB

MD5
da5033d7bc71549b7674fecb680d8b07

SHA1
8b6de309ac6e4c7dd13461f8dacb835c18382030

SHA256
7f05e399a61caad067c06ed46a9f20522d96fac03298ed23ff8b26c52bff2ac4

SHA512
e0a2d05e78b9fc6bc535869c812062a0a43ceb1eb998b7d9e7a9ee1861149c7261f1eb666f5dae6da1386963535b2f5d749683a1cba75873bb6a2a7e29eda7f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe

Filesize
468KB

MD5
809d354519f9bf4f569290823221ef45

SHA1
4b70052efea32890d8f0b3ee7341a75883c18d3e

SHA256
e4eadc5e138ffad67273caa440815719de385c16be3373bc4eb4ce0d7247e03b

SHA512
a81113a1b7965b0a3e56c727476f8013cb1e1258fcd4ace16cc42e9dccae2b1b18e147a743d15cae538ef6e1f6abdc7c526e162af1dae854a6773a855b136950

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe

Filesize
468KB

MD5
2e05503eb3acc0c4972765b6a8a4abcc

SHA1
e3125c94c4064d82ae71194dc1adc712a2ab5bd5

SHA256
d4e4f467ff4a284d461bcc1c15ffe15a6781ac446be761ee587c1a5209cf70a7

SHA512
560a2f6c8f0b8d33e71b1eadd934377f7a9a8c35925f49b23a5302ad1a3e88ab48dfc9c9a9173e4d030f0211d643354b76e815e0574ce3c256c72e10d5337ca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe

Filesize
468KB

MD5
7335405bbdf27ca3ba8a4c7f7cfde837

SHA1
30a950a5e022ea4feeb3e60a1a44f77072ea531d

SHA256
785cec9b3145a08a495f18c95bfd2a914cc3c49f62ab31ee4d6b08fe375beafd

SHA512
afac909e33c31af5c2a2540e903c47d462416dab32511816d8ba7e7254ae39dce6f4e74d0346658e653f11aa90cd6f6eb458af3c7d09f7d4b3a6ac8b3f4034e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe

Filesize
468KB

MD5
3fa4ed06a25d1649d4fbf98f76244a66

SHA1
7280ad0b48880d1b3cc8f3d6e5a8eef8c6b51b81

SHA256
5650fc6546300346a8097e38a4cc1d6ca2a5168aee0d42b45d215a88a80c0844

SHA512
af2d8b0a28c6a85152a7bed5557a17ee3e1a28f2ee4f9e073b0308fc5b15f58a92b5efffadaa4736678b6ec101e8f121631520103977de70d8bce40d1fbbabee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe

Filesize
468KB

MD5
a9ec18f7cd37daef6a70d87504a9cf13

SHA1
04979d10182a480216f54f45d2771fb9253a4ab5

SHA256
3db3abb31d6ea80655f8792709b33fb36bdbefb9ecc5ea012034683ec8c817d5

SHA512
2c466301aae17e980e6609e3c0de0ce0ca196e5bb7fb626641763a160728e668775f29fca619dc9094dbb6b6c6914188961e01d05a5be65a316348a0c8d25e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe

Filesize
468KB

MD5
9755af55caea32fcc10fb4c92393a75f

SHA1
168c4c1fc4de0b4e2a1aacba743ccd66759af78d

SHA256
3adb9c58c0a683250d6cfe9e3e1d469b953fb0d6a7766d1e199a996288448ced

SHA512
5f3fbc62de5591740672e70022f846dee69a03b850814e457aac4a444c19cab933030e99c0b25af421990cf8cbbc78884a62156c0c2a3d1f4cb3f49a9ec745f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe

Filesize
468KB

MD5
6fa2d59d82829dce665d925c022664df

SHA1
8572ebb8e6a53bf2a4177e3b9beca3f6322e799a

SHA256
560a0c3795fb9a8a9eedfb9138f66af8632deb88fbb2acf94f568f6aa90c0e00

SHA512
ced3c91a1e35a604f9a80abddbfbadcd74f3e74c6849047a296a3a400b8a1c4a384c18b353cc767dbd5649d4c9fd29d1005166d08e7d5c457421f91cb87065df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe

Filesize
468KB

MD5
4de5afdec6dc09693940dc478fb0101f

SHA1
ec52c8a6d3fd2482c5a56ddf9f09b357bfb31f0d

SHA256
36f0a32d56ebaf53152b558a700de7427340b267866348a12b243a3251a0b11c

SHA512
6aabeed8032615692358179d35a22260b91ca0ce28ee7dd51122fd6b53666eff03ca94fcd59dbc8f4a6a3d1af40b44c89c21a3adbf413b9101300fee7e5e4dc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe

Filesize
468KB

MD5
129b44e53051ffa7a12d557827e3f5d7

SHA1
02ff6bd4403ed77dc9530141b37b5a14f12f25e6

SHA256
43d95abc7024ed79e0f112e2f2f3e886aa13dc46101549092c2ac5a0ea4ccc55

SHA512
5af1ec0bfa6b1fe1789e77b907b102a678eea80fff1053347a04539cc1dfdeb11a375412a742de8dba7a351a098e4798da416aa0fa664921b995b6d0766519a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe

Filesize
468KB

MD5
f02b371cb239114dff5d9cdce8446d16

SHA1
4216dad20074874166099a00051e40ac4b74a35c

SHA256
370dc9360a3577427f6414519612d07f51324a68ab400fa401522d18157d2c1e

SHA512
a9963f80a930b78225bf69023515df6be4d31bfe20026a7db1d169287af5eb6e3a54cc854688fab131206b9b72d8acc4b2f55e8310e38051c99c7af6d30122f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe

Filesize
468KB

MD5
68ad94647d5f37e95d8e89acc7e678c4

SHA1
c93e60ff60969da734050acc9075b6f9548d5f83

SHA256
5312dccc89237c02b993f5290228486dfc9dd54c98fb70f0eb54caeab5a332af

SHA512
5fc64ffdb2e8368cadc382dee0d8615525900a1aa422673c42cf2ba0ed39477001ad521d0a79c60a053df87f0bb3a2896e2a2f5f08cd6cac9e91ed99fff357ac

Download Submit
memory/220-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/336-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/780-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/780-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1032-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3140-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3356-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3376-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3376-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3544-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4168-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4204-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-3156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4680-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5520-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5536-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5552-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5732-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5752-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5760-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5768-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5808-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6060-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6068-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6076-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6084-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6112-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6120-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download