1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87

Analysis

max time kernel
119s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe
Size

468KB
MD5

a57f5368d281065ea89725ecf2d56150
SHA1

3764384c56c7f740b2baf7eab5afc6cd42cb4a2e
SHA256

1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87
SHA512

2ac89b5f1ce3815625758965844c79f033b54e5b7b78837b82bcfb4402ea6ec0401332f02bb88045f175de62bff123a5fe5d8c6902396baf2d286231f42aa325
SSDEEP

3072:dbXWog5+Ps8b2OY/Pzivff8/+CWAl4pihdHeZVf4sRDNSM8TFPYw:dbmohhb2TPevff8EvEsRRf8TF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4752	Unicorn-33068.exe
1592	Unicorn-17884.exe
800	Unicorn-2102.exe
4932	Unicorn-20982.exe
4992	Unicorn-20982.exe
224	Unicorn-5200.exe
2020	Unicorn-18935.exe
4312	Unicorn-51454.exe
4836	Unicorn-55273.exe
2580	Unicorn-34926.exe
4652	Unicorn-21282.exe
1596	Unicorn-41148.exe
2632	Unicorn-39102.exe
380	Unicorn-14505.exe
4872	Unicorn-29450.exe
1760	Unicorn-25772.exe
2924	Unicorn-33940.exe
1212	Unicorn-18158.exe
4380	Unicorn-61766.exe
4568	Unicorn-61158.exe
3060	Unicorn-34516.exe
2044	Unicorn-34251.exe
3656	Unicorn-52990.exe
2012	Unicorn-33124.exe
2396	Unicorn-33124.exe
2848	Unicorn-28294.exe
5084	Unicorn-22163.exe
2428	Unicorn-1651.exe
1380	Unicorn-65142.exe
4296	Unicorn-52990.exe
1604	Unicorn-51407.exe
3952	Unicorn-37038.exe
1116	Unicorn-16618.exe
3476	Unicorn-62289.exe
2804	Unicorn-20702.exe
1828	Unicorn-42444.exe
844	Unicorn-25453.exe
232	Unicorn-31584.exe
3236	Unicorn-14286.exe
4408	Unicorn-58034.exe
2576	Unicorn-58034.exe
3600	Unicorn-63302.exe
4620	Unicorn-23778.exe
4544	Unicorn-3187.exe
3400	Unicorn-42082.exe
992	Unicorn-63249.exe
5080	Unicorn-21662.exe
1232	Unicorn-56472.exe
4132	Unicorn-35860.exe
1688	Unicorn-15994.exe
2256	Unicorn-20078.exe
4116	Unicorn-39679.exe
1680	Unicorn-11355.exe
2220	Unicorn-11355.exe
3624	Unicorn-19524.exe
972	Unicorn-17477.exe
3588	Unicorn-29638.exe
4376	Unicorn-29638.exe
4980	Unicorn-27591.exe
796	Unicorn-2730.exe
2676	Unicorn-3742.exe
4356	Unicorn-52751.exe
3388	Unicorn-949.exe
4244	Unicorn-21854.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3108	3976	WerFault.exe	171
15356	15020	WerFault.exe	726
14428	15128	WerFault.exe	736
14444	12700	WerFault.exe	633
15392	16088	WerFault.exe	885

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51599.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15996	dwm.exe
Token: SeChangeNotifyPrivilege	15996	dwm.exe
Token: 33	15996	dwm.exe
Token: SeIncBasePriorityPrivilege	15996	dwm.exe
Token: SeCreateGlobalPrivilege	1364	dwm.exe
Token: SeChangeNotifyPrivilege	1364	dwm.exe
Token: 33	1364	dwm.exe
Token: SeIncBasePriorityPrivilege	1364	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe
4752	Unicorn-33068.exe
800	Unicorn-2102.exe
1592	Unicorn-17884.exe
4932	Unicorn-20982.exe
4992	Unicorn-20982.exe
2020	Unicorn-18935.exe
224	Unicorn-5200.exe
4312	Unicorn-51454.exe
4836	Unicorn-55273.exe
2580	Unicorn-34926.exe
2632	Unicorn-39102.exe
4872	Unicorn-29450.exe
380	Unicorn-14505.exe
4652	Unicorn-21282.exe
1596	Unicorn-41148.exe
1760	Unicorn-25772.exe
2924	Unicorn-33940.exe
1212	Unicorn-18158.exe
4380	Unicorn-61766.exe
4568	Unicorn-61158.exe
2044	Unicorn-34251.exe
3060	Unicorn-34516.exe
2848	Unicorn-28294.exe
1380	Unicorn-65142.exe
2428	Unicorn-1651.exe
1604	Unicorn-51407.exe
4296	Unicorn-52990.exe
5084	Unicorn-22163.exe
3656	Unicorn-52990.exe
2012	Unicorn-33124.exe
2396	Unicorn-33124.exe
3952	Unicorn-37038.exe
1116	Unicorn-16618.exe
2804	Unicorn-20702.exe
3476	Unicorn-62289.exe
232	Unicorn-31584.exe
844	Unicorn-25453.exe
3236	Unicorn-14286.exe
1828	Unicorn-42444.exe
2576	Unicorn-58034.exe
4408	Unicorn-58034.exe
3600	Unicorn-63302.exe
4620	Unicorn-23778.exe
4544	Unicorn-3187.exe
3400	Unicorn-42082.exe
992	Unicorn-63249.exe
5080	Unicorn-21662.exe
4116	Unicorn-39679.exe
1688	Unicorn-15994.exe
1232	Unicorn-56472.exe
2256	Unicorn-20078.exe
4132	Unicorn-35860.exe
1680	Unicorn-11355.exe
3588	Unicorn-29638.exe
796	Unicorn-2730.exe
4980	Unicorn-27591.exe
972	Unicorn-17477.exe
4376	Unicorn-29638.exe
3624	Unicorn-19524.exe
4356	Unicorn-52751.exe
2676	Unicorn-3742.exe
3388	Unicorn-949.exe
2220	Unicorn-11355.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4752	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	84
PID 2264 wrote to memory of 4752	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	84
PID 2264 wrote to memory of 4752	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	84
PID 4752 wrote to memory of 1592	4752	Unicorn-33068.exe	85
PID 4752 wrote to memory of 1592	4752	Unicorn-33068.exe	85
PID 4752 wrote to memory of 1592	4752	Unicorn-33068.exe	85
PID 2264 wrote to memory of 800	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	86
PID 2264 wrote to memory of 800	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	86
PID 2264 wrote to memory of 800	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	86
PID 1592 wrote to memory of 4932	1592	Unicorn-17884.exe	89
PID 1592 wrote to memory of 4932	1592	Unicorn-17884.exe	89
PID 1592 wrote to memory of 4932	1592	Unicorn-17884.exe	89
PID 800 wrote to memory of 4992	800	Unicorn-2102.exe	90
PID 800 wrote to memory of 4992	800	Unicorn-2102.exe	90
PID 800 wrote to memory of 4992	800	Unicorn-2102.exe	90
PID 4752 wrote to memory of 224	4752	Unicorn-33068.exe	91
PID 4752 wrote to memory of 224	4752	Unicorn-33068.exe	91
PID 4752 wrote to memory of 224	4752	Unicorn-33068.exe	91
PID 2264 wrote to memory of 2020	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	92
PID 2264 wrote to memory of 2020	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	92
PID 2264 wrote to memory of 2020	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	92
PID 2020 wrote to memory of 4312	2020	Unicorn-18935.exe	95
PID 2020 wrote to memory of 4312	2020	Unicorn-18935.exe	95
PID 2020 wrote to memory of 4312	2020	Unicorn-18935.exe	95
PID 2264 wrote to memory of 4836	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	96
PID 2264 wrote to memory of 4836	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	96
PID 2264 wrote to memory of 4836	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	96
PID 4992 wrote to memory of 2580	4992	Unicorn-20982.exe	97
PID 4992 wrote to memory of 2580	4992	Unicorn-20982.exe	97
PID 4992 wrote to memory of 2580	4992	Unicorn-20982.exe	97
PID 800 wrote to memory of 4652	800	Unicorn-2102.exe	98
PID 800 wrote to memory of 4652	800	Unicorn-2102.exe	98
PID 800 wrote to memory of 4652	800	Unicorn-2102.exe	98
PID 224 wrote to memory of 1596	224	Unicorn-5200.exe	99
PID 224 wrote to memory of 1596	224	Unicorn-5200.exe	99
PID 224 wrote to memory of 1596	224	Unicorn-5200.exe	99
PID 4752 wrote to memory of 2632	4752	Unicorn-33068.exe	100
PID 4752 wrote to memory of 2632	4752	Unicorn-33068.exe	100
PID 4752 wrote to memory of 2632	4752	Unicorn-33068.exe	100
PID 4932 wrote to memory of 380	4932	Unicorn-20982.exe	101
PID 4932 wrote to memory of 380	4932	Unicorn-20982.exe	101
PID 4932 wrote to memory of 380	4932	Unicorn-20982.exe	101
PID 1592 wrote to memory of 4872	1592	Unicorn-17884.exe	102
PID 1592 wrote to memory of 4872	1592	Unicorn-17884.exe	102
PID 1592 wrote to memory of 4872	1592	Unicorn-17884.exe	102
PID 4312 wrote to memory of 1760	4312	Unicorn-51454.exe	104
PID 4312 wrote to memory of 1760	4312	Unicorn-51454.exe	104
PID 4312 wrote to memory of 1760	4312	Unicorn-51454.exe	104
PID 4836 wrote to memory of 2924	4836	Unicorn-55273.exe	105
PID 4836 wrote to memory of 2924	4836	Unicorn-55273.exe	105
PID 4836 wrote to memory of 2924	4836	Unicorn-55273.exe	105
PID 2020 wrote to memory of 1212	2020	Unicorn-18935.exe	106
PID 2020 wrote to memory of 1212	2020	Unicorn-18935.exe	106
PID 2020 wrote to memory of 1212	2020	Unicorn-18935.exe	106
PID 2264 wrote to memory of 4380	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	107
PID 2264 wrote to memory of 4380	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	107
PID 2264 wrote to memory of 4380	2264	1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe	107
PID 2632 wrote to memory of 4568	2632	Unicorn-39102.exe	109
PID 2632 wrote to memory of 4568	2632	Unicorn-39102.exe	109
PID 2632 wrote to memory of 4568	2632	Unicorn-39102.exe	109
PID 2580 wrote to memory of 3060	2580	Unicorn-34926.exe	110
PID 2580 wrote to memory of 3060	2580	Unicorn-34926.exe	110
PID 2580 wrote to memory of 3060	2580	Unicorn-34926.exe	110
PID 4752 wrote to memory of 2044	4752	Unicorn-33068.exe	111

C:\Users\Admin\AppData\Local\Temp\1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe
"C:\Users\Admin\AppData\Local\Temp\1fb463918d4e99f8c49fb56e6dcde2d5b3d8f19b71285dc8c74fb5e1b05b5a87N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        9⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        10⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        10⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe
        9⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
        9⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        8⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        8⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        8⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24710.exe
        9⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        9⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
        7⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3742.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28956.exe
        9⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        9⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        9⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        9⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
        8⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        8⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        8⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        7⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        7⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        6⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21146.exe
        7⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        6⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        9⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        9⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        8⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        7⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        6⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46140.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        7⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        7⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18834.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe
        7⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        6⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        7⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        8⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        8⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        7⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
        7⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        6⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
        7⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe
        6⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        7⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        5⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53617.exe
        5⤵
        
        PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        7⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        7⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        6⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        5⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        5⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        7⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        6⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18046.exe
        5⤵
        
        PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        6⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        5⤵
        
        PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
      4⤵
      PID:12668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        9⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        10⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50071.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        9⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
        8⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        9⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37538.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        7⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        7⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45066.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        8⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exe
        7⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        6⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe
        9⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
        10⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        10⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        9⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        9⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        7⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42164.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        8⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        7⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63440.exe
        6⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        7⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        6⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56346.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        7⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        6⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
        6⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        5⤵
        
        PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34846.exe
        7⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        6⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        7⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        6⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        6⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        7⤵
        
        PID:15020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15020 -s 80
        8⤵
        Program crash
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
        5⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        5⤵
        
        PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        6⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        5⤵
        
        PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        6⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18298.exe
      4⤵
      PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        9⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        9⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16272.exe
        8⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41378.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53434.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        7⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        7⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        6⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
        6⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21422.exe
        5⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
        7⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        6⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        5⤵
        
        PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        5⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        8⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        6⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        7⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        7⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        5⤵
        
        PID:13424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        6⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        5⤵
        
        PID:16100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        5⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        6⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe
        6⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        5⤵
        
        PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
      4⤵
      PID:12492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34251.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exe
        5⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        6⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12700 -s 464
        7⤵
        Program crash
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        5⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5496.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        5⤵
        
        PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
      4⤵
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        6⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34798.exe
        7⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        6⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57306.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        5⤵
        
        PID:15684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        6⤵
        
        PID:15128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15128 -s 72
        7⤵
        Program crash
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        5⤵
        
        PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30027.exe
      4⤵
      PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
      4⤵
      PID:13520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63302.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
      4⤵
      PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        5⤵
        
        PID:15736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        5⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        6⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        5⤵
        
        PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
      4⤵
      PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
      4⤵
      PID:13536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
    3⤵
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29994.exe
        6⤵
        
        PID:15004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        6⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        5⤵
        
        PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
      4⤵
      PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
      4⤵
      PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
    3⤵
    PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17656.exe
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
      4⤵
      PID:11780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
    3⤵
    PID:8376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
    3⤵
    PID:11636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2102.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
        9⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        7⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
        7⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        8⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50393.exe
        8⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        7⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63249.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4370.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        7⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        6⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        6⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
        5⤵
        
        PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35860.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28956.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        9⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16350.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        7⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        7⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        6⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31286.exe
        7⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        8⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        8⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        7⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        6⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
        5⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        5⤵
        
        PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        7⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        6⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
        5⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        5⤵
        
        PID:13456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        5⤵
        
        PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
      4⤵
      PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        5⤵
        
        PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
      4⤵
      PID:11904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        7⤵
        
        PID:16088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16088 -s 72
        8⤵
        Program crash
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
        7⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        7⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        5⤵
        
        PID:13032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        6⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        7⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        7⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        6⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
        5⤵
        
        PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12686.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        5⤵
        
        PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
      4⤵
      PID:13504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
        7⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
        6⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        5⤵
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        5⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48535.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
        6⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        5⤵
        
        PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
      4⤵
      PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
      4⤵
      PID:668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        6⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
        5⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        5⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
      4⤵
      PID:11864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        5⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        5⤵
        
        PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
      4⤵
      PID:12484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
    3⤵
    PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
    3⤵
    PID:12756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
    3⤵
    PID:15380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21854.exe
        6⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        9⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        9⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31891.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        7⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        6⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        8⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        7⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        6⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        8⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        8⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        7⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        6⤵
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        7⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        5⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        6⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        5⤵
        
        PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        5⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        7⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46886.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23185.exe
        6⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        7⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
        6⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
        5⤵
        
        PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
      4⤵
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42248.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        7⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        6⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2642.exe
        5⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        6⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        5⤵
        
        PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        5⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        6⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        5⤵
        
        PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
      4⤵
      PID:11664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        5⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exe
        6⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        7⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        6⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23185.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        5⤵
        
        PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        7⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        6⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        5⤵
        
        PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
      4⤵
      PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
      4⤵
      PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
      4⤵
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
      4⤵
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        6⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        5⤵
        
        PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        5⤵
        
        PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51599.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
      4⤵
      PID:13208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36567.exe
      4⤵
      PID:16284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
    3⤵
    PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        6⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        5⤵
        
        PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
      4⤵
      PID:8672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
      4⤵
      PID:13028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
    3⤵
    PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe
      4⤵
      PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
      4⤵
      PID:14492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
      4⤵
      PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
    3⤵
    PID:8964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
    3⤵
    PID:1928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        5⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exe
        6⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39254.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        8⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
        7⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        7⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        6⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        6⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51686.exe
        5⤵
        
        PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
      4⤵
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        5⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        5⤵
        
        PID:12352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        6⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        5⤵
        
        PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      4⤵
      PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        5⤵
        
        PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
      4⤵
      PID:464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
      4⤵
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        5⤵
        
        PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe
        5⤵
        
        PID:14092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        5⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
      4⤵
      PID:11080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35158.exe
    3⤵
    PID:3976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 488
      4⤵
      Program crash
      PID:3108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
    3⤵
    PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25120.exe
      4⤵
      PID:14344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
    3⤵
    PID:1620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
      4⤵
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52746.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        6⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        5⤵
        
        PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe
      4⤵
      PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
      4⤵
      PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
      4⤵
      PID:8300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23774.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        6⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19614.exe
        5⤵
        
        PID:15248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
      4⤵
      PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
      4⤵
      PID:15832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63684.exe
    3⤵
    PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
      4⤵
      PID:13172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
    3⤵
    PID:9000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
    3⤵
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exe
      4⤵
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        6⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36688.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
        7⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2073.exe
        6⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
      4⤵
      PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
      4⤵
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
    3⤵
    PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        5⤵
        
        PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
      4⤵
      PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
    3⤵
    PID:8424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
    3⤵
    PID:13528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
  2⤵
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
    3⤵
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
      4⤵
      PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
      4⤵
      PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      4⤵
      PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
    3⤵
    PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
    3⤵
    PID:14580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
    3⤵
    PID:1252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
  2⤵
  PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
    3⤵
    PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
      4⤵
      PID:13316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41736.exe
    3⤵
    PID:11788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
  2⤵
  PID:8272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
    3⤵
    PID:13864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
  2⤵
  PID:11548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3976 -ip 3976
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 15128 -ip 15128
1⤵
PID:14020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 13980 -ip 13980
1⤵
PID:13072

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:15996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 16088 -ip 16088
1⤵
PID:16324

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2276

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4908

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2468

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1804

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1628

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:15624

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\4c9b007941cf4c3e9730b2c6b20f1db4 /t 3856 /p 3828
1⤵
PID:4772

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\81963a105a904f8491d25c911563d62a /t 4308 /p 4128
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe

Filesize
468KB

MD5
8d014518b40c51cc258828d2f89a9a4e

SHA1
8c82c1fdb4a9d9582323e4c0ea08d50eb1e34a1e

SHA256
cfbfb6ca5ca85fc8f70a7c5b28493580e133f024c9a7fe4f5bf0eee8d179ff40

SHA512
4f2af4c4b12eb706a7a1e40233e553fc06839ca90e8755c9f02c526b5eb6b95f39d0758587da38a821abd0baaf2c206a2088c78e911b6b0e0cf50b2eac6c2990

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe

Filesize
468KB

MD5
8d890d684ca1e7f8d72afbd8e867ae50

SHA1
5874b3d180aa09f2baa9ee5ed585bec13ceef272

SHA256
c98ee231c37b3913a61554acab34081d52b996ba7f62b198375921ec98e6cbf2

SHA512
c5a2a77f823b556523d2a268176acdaadb58ca7e9dfe7495a45c70d7eafeef9a9e4884e190906724b2abfc857d4c6f86f34332c92f391d3a1c4945382eb47bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe

Filesize
468KB

MD5
80bbde04d01c10a39a882ab9d4a86937

SHA1
6d66fcc4b596393718a9dbe9ae01113c33863570

SHA256
be744d6a22d5e2de2b33aff53a07130106b4283a06ab1ce1393b5a55a30dd07a

SHA512
0a91c4ca5ecdd64811f9dcaaaf413803334972f09817adfec9298d4681fd7efd1ad637bdeed03eb3c1f088d379a67eec1c2b8b9cda615a35fa2857f7427d4c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe

Filesize
468KB

MD5
b909479c62f3176e227c8d493b442b18

SHA1
75f2757d17665269d7e4aaab71ad25b069497365

SHA256
4ba43a1525fce312b50d3066b40fe132fc0be5afc1811111a7f5684b2ec37a98

SHA512
d3a8b26257a303181326f6663417e79c77853b60a7997f131459cac6c786e58407213ecf42419dbb94a7effc48dce2af9089bd1f91dd938409f41c867aa2cebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe

Filesize
468KB

MD5
95b5cdecd151f8c8efdd670c57acf239

SHA1
e24a652c7af7bb05b01a1122841fb724b4d38094

SHA256
764e760087c9d68216317a3fd179a65fab0c45ee979db09f3e6293bd349f4b74

SHA512
26bb4b1780599c7f2ab6b44e49e6f18a87fc0e47961c1fdf663fb1d9c126a2b73355709e055061f75f3b0eff7ad741bbd02c1fe0d06e0a831ca5b7e72ca57b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe

Filesize
468KB

MD5
88fc37cdfb9b0868904968f36a3a1dc5

SHA1
a9df48e3acfabdbf980069198115c7f78dab4a55

SHA256
6859f584f89f2374a71bada52c9926729e100ba6ee03e7566da7a17051614ac9

SHA512
3b8b74338f0dd3909ec6789baa3caa082047026069233f8fe076683d104b7c130938f471318824e38cd97faa2b3c7aee2207f970f0307a1241d99a56556fdb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe

Filesize
468KB

MD5
a0ca70f3833458670cba95a01f93bc31

SHA1
54d0d7507963cef94be475ee6d206c37d9334dc0

SHA256
cc6719922dfc69959ded7110d3ef800958f26b449489de370a730a5240f20fc7

SHA512
c8afa6d1c9bb609727227f4c75706d9fc5843a6e0e96e14c3f6871608583f85d467413f41560ffbc8e160298d6b7076c4b45dbe8e44c55ee44e5ef59df539912

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2102.exe

Filesize
468KB

MD5
37b992c636d6251ae4fcfdb46f14ab37

SHA1
b3357933081be13f52641c2a65acbc137981b192

SHA256
dab5d68a3534cc7182fc8623f53da53090e21290c517f13b58a049f27b8aa6a4

SHA512
b628dfb4be8191ee52383ed22b5e84287957468e770af91bd9b3e6b0c83790322b5427078670046b8f61b1f64c9313bb248452850cbb28f94e63cb4e10ee0dc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe

Filesize
468KB

MD5
316ec4fcc3a64ba4a050912d1d239d44

SHA1
dcde6f59244e72f0f0a748873df89d4dc1f71159

SHA256
74e74142a8724d15eec7128f952645b0ce37d1a99699d756955f359be18f5ea9

SHA512
3e08557d8e8dc0bc9f8eb7d723f8ccbb969a3e90eb780ce1708f19fcfa86da5c5832b181d7d7fb013aa09a0501c3c49c6db4d644fe3e70d379fae2a9d62197c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe

Filesize
468KB

MD5
8925332b85e9e122d2b2e7d3b491cd17

SHA1
b232f280a8968e95b6996e9d59c286ab1eba0327

SHA256
7cf2d373719302617817a1c5f31202562ce92cd19fe7a7014aed9ec32097113c

SHA512
124b132d25a42c9546b5a78d3993569c04c53891da52b138bc216a96c74f9abc7ecb87405739663078f1054d394819b8389a19561bb59f78b19d19abc6015aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25772.exe

Filesize
468KB

MD5
197fa027d0a4f3f65c2c5fa77eaf7f44

SHA1
e1f62eab9acad8e1020a796a3d0282e6d9279ebc

SHA256
c59b77e7e328dce9e2642f1482057bfc7b6a50e22baafbb424a985b5db7da0f5

SHA512
4a0accee26752cf64e2dcbb2d9021fe09a0bbe7dfeb730275d136b9652f1d7d48d7f2c0757c0fc47ae6aad4fa20352307819db595e65d8be1b753f2f49edc411

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe

Filesize
468KB

MD5
3ca70dc85014f20cfdc612bd7a4a19a9

SHA1
fdba278a8bf1312effac6cf7545a1095f51e8100

SHA256
58a3c31785abd0f83f77a9f165bd950126fc93acfc9c691ce879b1973a61a1ee

SHA512
ff3d41cf9167b0e123781439182fad0008f204c1a641332672f2c6d806dd0c30cbfddb66a154287f4ed1f984ea230ba9ec3bb6418c135ea875a8e4840d333f85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe

Filesize
468KB

MD5
97e8dadf832a93f5c4db624fd2ebc69f

SHA1
895a9a3332d831fd7b08013921ffcbce36b9e235

SHA256
0b9a0bae7b492a0d328e693e9f354b7aba26e4d48c0629c88c528f539381b430

SHA512
fc04dae5c3839c88e012f6fbcc3f18637810d2e086f279d8922da83d2c340470e504f98c9afe80669caa3582b8cc3e9f9a871a1129ba4aab46080f1fa3dc1c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe

Filesize
468KB

MD5
0875f0069b353432a8d564e149b4f548

SHA1
529fc73602e44586d4857f63a49ebafd3910d58a

SHA256
4dca631fdb5dfbeb2588da8aa2df17471589f2d6556917d2b358862b9b4430b7

SHA512
0dfcdba75ecb996dd99a89eb9661f27b78d9be8ab6475ed5a3e8e7b599d746aaf86fad5919b18369afebcdb759d719da5444e1389564212358d3fbb5023d58ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe

Filesize
468KB

MD5
938dbf6f851f4c0d56fddd59b16a90b0

SHA1
66dd97a89cdbc750bae976bbedf5802eff9d74af

SHA256
f1f5422f9120d5a3c6bea2117c7294fd339f2df11b1141c135e2efb92d8d6c37

SHA512
1c7979020ff8ba66e8b81bd300083979c1ba204a8d53b96fc97daf68c528a832fca176ea221b7962a147cadfb9e0ed8351c13472f7b96e0131ead355a70b789a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe

Filesize
468KB

MD5
61f20a296da427194a7174c393980af4

SHA1
b8fb46ed6e7087d9fc2bd92c54f959f37a1bb14a

SHA256
5dd5aaf94993e91584f29b72c27d76172b553f882a711f8079d57f28f6378704

SHA512
27a75a0264e15b5545d45b47378547066d537f33925643ef770966cd1f4cb2f0b81b58b36cf7d083d6e5e644dddd9277f02ea691b02b882b6a2a1bbef141c5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34251.exe

Filesize
468KB

MD5
652489efde82526fafee1bb4ce308e03

SHA1
9afb1506eca6d27e7a189cd562acd7802c7303be

SHA256
b680934bbab6c826707f44fb62350220d2c9ae7b07deb1e984185bcb8ba229aa

SHA512
bc234748b9ce4334fb2255f86635b099811bcce068e977a3c999be4033d9bc3c51f39e87bbe9aceb509a864fb6e7a707c7f0e09f9c278ad90a9bb143fb2ab579

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe

Filesize
468KB

MD5
a1220fc6cb88ff361062880e2e6b73b4

SHA1
59ed801bf777480eb989c66a3e7a07cd3216d17b

SHA256
394ba2a0211ed7a2b63b3f49997fb810a178193614b69683af607b6fb2fe3577

SHA512
26cbef63c7a9d0c94c09fca0481db7b287ea1df7b2869144097aea09fc85c47b354be1c46f59e67b18e4ab12b5cd00b7e5858e91a7a35128f5b61b8475967c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe

Filesize
468KB

MD5
f47b68250d21efa436448c85b3030b03

SHA1
dccc51ead990d2ba795a599261c0776a8c508dfe

SHA256
3f24b44db3e0fb643655dfe76f23a86c3cc2b1686ed7685a36121e57f03224a7

SHA512
b00dab93d2cb3f188b454300cced7c5ba3fb87f79c276cda51ff26404ddbb3caa99db6d145777dbfbe86d6b9d420ac41f3c11c63f647f0f6877c940a1851bbe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe

Filesize
468KB

MD5
ada2195c8c48087b4084e6bf8219443d

SHA1
159e016c2e2b1a4fe26a578609abd1e6a0297113

SHA256
7ed81eee23e06469d74cd6491954e4ba3d9ef88806a2c40f51a235648d30453f

SHA512
7e606a0caea71ce737f50c3a5199b39015c2f488b2d19e43de2aaeb698e752b38a1ccfe6b81f5724ae5437428cde51521d9ebd87cfdc82567e147e1c1af4bf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe

Filesize
468KB

MD5
db1f9653ff43679aa2ec212851f62485

SHA1
aaf38139fd419cc1869837030007f75137ed5f2a

SHA256
11db056fa845b7aa9d029b3c58294dfa177f9a3ab7c42801359df69dcd45a130

SHA512
791520105996dfee1cae0fae402b1edb7e0c432fb5ac158e3e84fa81722c5fe4dd55325ee7b2d9932b8c4cb9f903c95f55f608c7266b5cd85875d4f8e0dec8f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe

Filesize
468KB

MD5
11b4c39eb5568b06b2d8563ce7a959da

SHA1
0302876fc92ae3ddc788226d539ef692d315e424

SHA256
a8ea627e680f533c9de046146a7db030d10e7a3ab0e8a7b585cbb3a57878e495

SHA512
b350a31d13b86aa49275ade867b9db6a6e1ea342f702a2954afc974872f93c9d0e7ec29c193c3b9d69f40b4e81402482664dd0dc8d63fdabf5c994e42414d31e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe

Filesize
468KB

MD5
f9015ebfe7923e6e81fc1797b099bca1

SHA1
7b598e6492f276813f5e4f7af462fd6b93c96c27

SHA256
4e7cc84d3014120edbf8c7f5c5f3a030a9f8b5ec5ce1ebcf8129c73bbd0c40a9

SHA512
8c4501f8143712f679aa3f49697a04aebcd2e2d25402b13e066d4e8493901a14a02884450eb10ef3dee609b38ff00fe990249543ebea93e387248213ac50b2b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe

Filesize
468KB

MD5
58444d65aedbf8c0ffcb7ab596bf3f0f

SHA1
68b4a9a0aee9e3cfb0291fdc66be269b05cb6f6e

SHA256
3f9981e08a6519b2faaaffdfee58ff0205b4d8376455814591738ceaab79e947

SHA512
47b326ed6c4abc1379dfa234a22786857260350657f71d9490c85fa264b00c0b415ec807049d0d5c3d37a623d8fec099aaef6804958d8e8e9a0ceb01de0ddc34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe

Filesize
468KB

MD5
0aef5482915c08f093e28fcc38f31d0e

SHA1
9004c9cdcf700f615cf6d8f5bd897cbada8151b9

SHA256
70a4b25c1258ff79ad50857264fc427d0f3dc2a504b16bb40159a764b187b588

SHA512
8ef9c9bad3d6462f56f7fe6d780c93f08450a8bfc0119ded929625952ff5445fda09ffadeeff5d70124d6e6837e6e1d6f04f81b9ed93ca51f5d60018eeaba178

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe

Filesize
468KB

MD5
a124ce5b65a54b974934cd2f203724be

SHA1
308006b3a3df00eb384a0f1cde061de0f80b1429

SHA256
25f951e41ba199a0a98e4e6fc28103424286721527cb053bfe9834d285c1b748

SHA512
a0910cb9fdb49c89f25c32f9ddd316457f5c1d8b197cdd2d6a2721b4277304e962d8d0892c43f1b3c386dbcbcb5acf671fd4d2c0bdca82844cc4632d0baa2a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe

Filesize
468KB

MD5
2dcb19028d6b4792e2244568f49cb4f0

SHA1
16503037831778b3c447b1353652a096e50422f1

SHA256
45690f9f0b498f478e17c7d49f6e3000f41b06a12707ef3fc59985846b74d898

SHA512
c7a8457344dc8f1bd56444816cfec9bd63ee5ba6651261f6581a0d09f110bb286e720f6f15d423a1ec0f9dec56c0dc04d07bad1dae6769755d6ec8043a3d6ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe

Filesize
468KB

MD5
fac8517ca41129c0294c2428ac5cb327

SHA1
9709ed1649d4b4d6a3bcfcea903d87f48921d9bb

SHA256
551c9d06d486c2c5377129526b2c38b59e7a0747d76a36d26327364b48ca6b5e

SHA512
9ea9e220e250b25047dbcb1d60a132dd35e9386e7e178c7139cfafa6beb18f2d1cdd305cdc6c829c3edb5353dba0413a92a6e66bdef64e0bbafa6405b8e4224f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe

Filesize
468KB

MD5
df3e9cd2ac723e798149685e6c910253

SHA1
71e34589c2f59f73053935612327846ece0c3ecf

SHA256
634c2cbe197f2df93098cfd161c2ab7d193fafe5121e282536cfc0afdf09b806

SHA512
7bb6460ebeef6207ab94e6c7f4622445196a386c71d9fe7288ec201714308de00f98b3c97145066642c917c7ba4e1fcccc99541dc1c6db533e1b7b6ca739cab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe

Filesize
468KB

MD5
36a0028faf4d025d5f0adaabf0e282e8

SHA1
53de11b1f58df1296cbab71fa35b297768d2e5f9

SHA256
fa1219d745ac22a84f69ab5d96f275716065f1a3b88c3d37f5f8d849e925e321

SHA512
28c1de55e46c8bbc3b8b1fa79a873f8aff1782c99872cd55a28bce9abb71153beb98c874f6077abc3b20179a6996400c8c6748d7a4fff8a09b013a406b7cc5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe

Filesize
468KB

MD5
e3ee6440467192f6bfa6763a0319f45b

SHA1
3732ce92d4f8060e0c44d8059392776448ff9e24

SHA256
cbf1c9e6e77a099b57fc8d353c240aa13c1a0d5a3b33654cb3573de21471603f

SHA512
b123f1578b392eec3d69e445ad6a66619d616e6d752a15eebcbb6f971500fcb9fbeb63fb2014beeeaa10717227f20c5f1ebc85a553cf98ed2eb257f37f3b4424

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65142.exe

Filesize
468KB

MD5
6b906b09fd7a3812da03a4066f373396

SHA1
95d724840ece8a67601d9f5deb9dce7131fef461

SHA256
5f4672fb535284d4a91ff21f283124535c67e3a1168b3b8cbc257bd2e3d75eea

SHA512
f30ff64f963a4380922d7ee5328870a0febc99ce7dcb342bb1fc6fd3f4745ff73aa69216c789af7a53ac8a414a634be338113da8a8fe898f0aaa1b63d389e7c7

Download Submit
memory/224-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/796-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/800-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/884-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/904-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1116-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1348-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-3141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3400-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4568-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4652-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5072-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5416-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5500-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5600-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5772-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13748-2530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14272-2731-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14344-2482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14972-2464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15096-2461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15996-3346-0x00007FF833330000-0x00007FF83378D000-memory.dmp

Filesize
4.4MB

Download