b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
Size

468KB
MD5

dfc7cb7bc74c454f0945f3ea610ac700
SHA1

8438b5ace4f0d9762b3e603c1cae9812de62e7d9
SHA256

b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473
SHA512

0d50bbac3e2b8cd48942b7892f0d6c79dc14e70c6c2bcd56d700c1481ab3ef3319130a89475c5d1f02c58faf479939a930ec7ebfec7b030a186c4ac0e74f35ba
SSDEEP

3072:mrz7ogKxjz8UFbYqPz3yqf8/Eptj7PpgPmHx+lIvEln0AcL1SDla:mrfotAUFxPDyqf/BtzEl0JL1S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2324	Unicorn-18550.exe
540	Unicorn-24025.exe
2732	Unicorn-8243.exe
1592	Unicorn-53656.exe
2852	Unicorn-31189.exe
2840	Unicorn-17454.exe
2604	Unicorn-37320.exe
2348	Unicorn-54014.exe
1872	Unicorn-20692.exe
3008	Unicorn-8705.exe
2692	Unicorn-33956.exe
1232	Unicorn-47553.exe
3024	Unicorn-1881.exe
2960	Unicorn-57906.exe
1896	Unicorn-61288.exe
2168	Unicorn-55021.exe
1088	Unicorn-43323.exe
1112	Unicorn-15332.exe
2572	Unicorn-10678.exe
1528	Unicorn-11056.exe
2264	Unicorn-39837.exe
1444	Unicorn-41683.exe
1620	Unicorn-23309.exe
1820	Unicorn-60428.exe
1040	Unicorn-14756.exe
2392	Unicorn-14756.exe
1552	Unicorn-57688.exe
1892	Unicorn-57688.exe
1588	Unicorn-11751.exe
2408	Unicorn-12016.exe
2684	Unicorn-41264.exe
2720	Unicorn-37542.exe
2768	Unicorn-49240.exe
2716	Unicorn-31750.exe
2792	Unicorn-61300.exe
2932	Unicorn-62047.exe
1328	Unicorn-10245.exe
1788	Unicorn-52940.exe
1388	Unicorn-12099.exe
2356	Unicorn-16821.exe
1972	Unicorn-485.exe
3012	Unicorn-57299.exe
2232	Unicorn-45815.exe
2360	Unicorn-45550.exe
1472	Unicorn-61581.exe
1492	Unicorn-9058.exe
1060	Unicorn-4974.exe
2488	Unicorn-27240.exe
840	Unicorn-27240.exe
1812	Unicorn-13505.exe
1520	Unicorn-4782.exe
1904	Unicorn-14796.exe
2528	Unicorn-20927.exe
1708	Unicorn-20927.exe
3036	Unicorn-20927.exe
1624	Unicorn-33925.exe
2612	Unicorn-17205.exe
2708	Unicorn-17205.exe
2776	Unicorn-62369.exe
2624	Unicorn-50823.exe
1800	Unicorn-9598.exe
1688	Unicorn-10375.exe
1288	Unicorn-16506.exe
1504	Unicorn-45286.exe

Loads dropped DLL 64 IoCs

pid	Process
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2324	Unicorn-18550.exe
2324	Unicorn-18550.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
540	Unicorn-24025.exe
540	Unicorn-24025.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2324	Unicorn-18550.exe
2324	Unicorn-18550.exe
2732	Unicorn-8243.exe
2732	Unicorn-8243.exe
2852	Unicorn-31189.exe
2852	Unicorn-31189.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
1592	Unicorn-53656.exe
1592	Unicorn-53656.exe
540	Unicorn-24025.exe
540	Unicorn-24025.exe
2604	Unicorn-37320.exe
2732	Unicorn-8243.exe
2324	Unicorn-18550.exe
2840	Unicorn-17454.exe
2732	Unicorn-8243.exe
2840	Unicorn-17454.exe
2604	Unicorn-37320.exe
2324	Unicorn-18550.exe
2348	Unicorn-54014.exe
2348	Unicorn-54014.exe
2852	Unicorn-31189.exe
2852	Unicorn-31189.exe
1872	Unicorn-20692.exe
1872	Unicorn-20692.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2692	Unicorn-33956.exe
2692	Unicorn-33956.exe
1232	Unicorn-47553.exe
1232	Unicorn-47553.exe
2732	Unicorn-8243.exe
2732	Unicorn-8243.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
3008	Unicorn-8705.exe
3008	Unicorn-8705.exe
1592	Unicorn-53656.exe
2960	Unicorn-57906.exe
3024	Unicorn-1881.exe
1592	Unicorn-53656.exe
2960	Unicorn-57906.exe
3024	Unicorn-1881.exe
2604	Unicorn-37320.exe
2840	Unicorn-17454.exe
2324	Unicorn-18550.exe
2604	Unicorn-37320.exe
2840	Unicorn-17454.exe
2324	Unicorn-18550.exe
1896	Unicorn-61288.exe
1896	Unicorn-61288.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2520	540	WerFault.exe	32
2636	1528	WerFault.exe	50
1720	1892	WerFault.exe	58
2136	2768	WerFault.exe	64
2688	2488	WerFault.exe	81
2328	1824	WerFault.exe	99
2196	916	WerFault.exe	125
2284	2644	WerFault.exe	124
1372	2392	WerFault.exe	56
3484	2588	WerFault.exe	100
3468	904	WerFault.exe	144
3624	532	WerFault.exe	130
3852	2628	WerFault.exe	112
4260	448	WerFault.exe	149
4576	1972	WerFault.exe	73
4500	2652	WerFault.exe	133
4996	2052	WerFault.exe	134
4564	1688	WerFault.exe	96
4648	2792	WerFault.exe	67
4652	1832	WerFault.exe	103
4696	1304	WerFault.exe	143
4740	1796	WerFault.exe	147
4788	2928	WerFault.exe	135
4488	1624	WerFault.exe	89
4476	2504	WerFault.exe	129
4492	3016	WerFault.exe	119
5192	2612	WerFault.exe	91
5356	1960	WerFault.exe	151
5868	2920	WerFault.exe	152
5784	1260	WerFault.exe	108
5772	676	WerFault.exe	121
5748	2992	WerFault.exe	115
5632	1060	WerFault.exe	80
5600	1552	WerFault.exe	59
1672	2900	WerFault.exe	117
6008	1856	WerFault.exe	195
944	680	WerFault.exe	123
6148	1040	WerFault.exe	57
6164	1812	WerFault.exe	84
6180	2832	WerFault.exe	177
6200	3032	WerFault.exe	138
6192	3024	WerFault.exe	45
6220	2984	WerFault.exe	167
6324	316	WerFault.exe	169
6348	2956	WerFault.exe	139
6272	1880	WerFault.exe	162
6228	1764	WerFault.exe	101
6612	2916	WerFault.exe	137
6240	2624	WerFault.exe	92
6468	2700	WerFault.exe	141
6656	3592	WerFault.exe	213
6664	2516	WerFault.exe	160
6512	2720	WerFault.exe	63
6116	2712	WerFault.exe	132
7184	1872	WerFault.exe	39
7708	2684	WerFault.exe	62
9180	2664	WerFault.exe	183
8336	1808	WerFault.exe	113
8300	2828	WerFault.exe	110
8808	2696	WerFault.exe	185
8296	2232	WerFault.exe	75
8752	1904	WerFault.exe	85
8948	2776	WerFault.exe	93
8928	1920	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20927.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
2324	Unicorn-18550.exe
540	Unicorn-24025.exe
2732	Unicorn-8243.exe
1592	Unicorn-53656.exe
2852	Unicorn-31189.exe
2840	Unicorn-17454.exe
2604	Unicorn-37320.exe
2348	Unicorn-54014.exe
1872	Unicorn-20692.exe
3008	Unicorn-8705.exe
2692	Unicorn-33956.exe
1232	Unicorn-47553.exe
3024	Unicorn-1881.exe
1896	Unicorn-61288.exe
2960	Unicorn-57906.exe
2168	Unicorn-55021.exe
1088	Unicorn-43323.exe
2572	Unicorn-10678.exe
1112	Unicorn-15332.exe
1528	Unicorn-11056.exe
2264	Unicorn-39837.exe
1444	Unicorn-41683.exe
1620	Unicorn-23309.exe
1820	Unicorn-60428.exe
1040	Unicorn-14756.exe
2392	Unicorn-14756.exe
1552	Unicorn-57688.exe
2408	Unicorn-12016.exe
1892	Unicorn-57688.exe
1588	Unicorn-11751.exe
2684	Unicorn-41264.exe
2720	Unicorn-37542.exe
2768	Unicorn-49240.exe
2716	Unicorn-31750.exe
1788	Unicorn-52940.exe
2932	Unicorn-62047.exe
1388	Unicorn-12099.exe
1328	Unicorn-10245.exe
2792	Unicorn-61300.exe
3012	Unicorn-57299.exe
2356	Unicorn-16821.exe
1972	Unicorn-485.exe
2232	Unicorn-45815.exe
2360	Unicorn-45550.exe
1060	Unicorn-4974.exe
1492	Unicorn-9058.exe
1472	Unicorn-61581.exe
2488	Unicorn-27240.exe
840	Unicorn-27240.exe
2528	Unicorn-20927.exe
1812	Unicorn-13505.exe
1520	Unicorn-4782.exe
1624	Unicorn-33925.exe
1904	Unicorn-14796.exe
3036	Unicorn-20927.exe
1708	Unicorn-20927.exe
2612	Unicorn-17205.exe
2708	Unicorn-17205.exe
1288	Unicorn-16506.exe
2776	Unicorn-62369.exe
2624	Unicorn-50823.exe
1800	Unicorn-9598.exe
1688	Unicorn-10375.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2324	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	30
PID 2120 wrote to memory of 2324	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	30
PID 2120 wrote to memory of 2324	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	30
PID 2120 wrote to memory of 2324	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	30
PID 2324 wrote to memory of 540	2324	Unicorn-18550.exe	32
PID 2324 wrote to memory of 540	2324	Unicorn-18550.exe	32
PID 2324 wrote to memory of 540	2324	Unicorn-18550.exe	32
PID 2324 wrote to memory of 540	2324	Unicorn-18550.exe	32
PID 2120 wrote to memory of 2732	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	33
PID 2120 wrote to memory of 2732	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	33
PID 2120 wrote to memory of 2732	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	33
PID 2120 wrote to memory of 2732	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	33
PID 540 wrote to memory of 1592	540	Unicorn-24025.exe	34
PID 540 wrote to memory of 1592	540	Unicorn-24025.exe	34
PID 540 wrote to memory of 1592	540	Unicorn-24025.exe	34
PID 540 wrote to memory of 1592	540	Unicorn-24025.exe	34
PID 2120 wrote to memory of 2852	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	35
PID 2120 wrote to memory of 2852	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	35
PID 2120 wrote to memory of 2852	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	35
PID 2120 wrote to memory of 2852	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	35
PID 2324 wrote to memory of 2840	2324	Unicorn-18550.exe	36
PID 2324 wrote to memory of 2840	2324	Unicorn-18550.exe	36
PID 2324 wrote to memory of 2840	2324	Unicorn-18550.exe	36
PID 2324 wrote to memory of 2840	2324	Unicorn-18550.exe	36
PID 2732 wrote to memory of 2604	2732	Unicorn-8243.exe	37
PID 2732 wrote to memory of 2604	2732	Unicorn-8243.exe	37
PID 2732 wrote to memory of 2604	2732	Unicorn-8243.exe	37
PID 2732 wrote to memory of 2604	2732	Unicorn-8243.exe	37
PID 2852 wrote to memory of 2348	2852	Unicorn-31189.exe	38
PID 2852 wrote to memory of 2348	2852	Unicorn-31189.exe	38
PID 2852 wrote to memory of 2348	2852	Unicorn-31189.exe	38
PID 2852 wrote to memory of 2348	2852	Unicorn-31189.exe	38
PID 2120 wrote to memory of 1872	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	39
PID 2120 wrote to memory of 1872	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	39
PID 2120 wrote to memory of 1872	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	39
PID 2120 wrote to memory of 1872	2120	b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe	39
PID 1592 wrote to memory of 3008	1592	Unicorn-53656.exe	40
PID 1592 wrote to memory of 3008	1592	Unicorn-53656.exe	40
PID 1592 wrote to memory of 3008	1592	Unicorn-53656.exe	40
PID 1592 wrote to memory of 3008	1592	Unicorn-53656.exe	40
PID 540 wrote to memory of 2692	540	Unicorn-24025.exe	41
PID 540 wrote to memory of 2692	540	Unicorn-24025.exe	41
PID 540 wrote to memory of 2692	540	Unicorn-24025.exe	41
PID 540 wrote to memory of 2692	540	Unicorn-24025.exe	41
PID 2732 wrote to memory of 1232	2732	Unicorn-8243.exe	43
PID 2732 wrote to memory of 1232	2732	Unicorn-8243.exe	43
PID 2732 wrote to memory of 1232	2732	Unicorn-8243.exe	43
PID 2732 wrote to memory of 1232	2732	Unicorn-8243.exe	43
PID 2840 wrote to memory of 3024	2840	Unicorn-17454.exe	45
PID 2840 wrote to memory of 3024	2840	Unicorn-17454.exe	45
PID 2840 wrote to memory of 3024	2840	Unicorn-17454.exe	45
PID 2840 wrote to memory of 3024	2840	Unicorn-17454.exe	45
PID 2604 wrote to memory of 2960	2604	Unicorn-37320.exe	42
PID 2604 wrote to memory of 2960	2604	Unicorn-37320.exe	42
PID 2604 wrote to memory of 2960	2604	Unicorn-37320.exe	42
PID 2604 wrote to memory of 2960	2604	Unicorn-37320.exe	42
PID 2324 wrote to memory of 1896	2324	Unicorn-18550.exe	44
PID 2324 wrote to memory of 1896	2324	Unicorn-18550.exe	44
PID 2324 wrote to memory of 1896	2324	Unicorn-18550.exe	44
PID 2324 wrote to memory of 1896	2324	Unicorn-18550.exe	44
PID 2348 wrote to memory of 2168	2348	Unicorn-54014.exe	46
PID 2348 wrote to memory of 2168	2348	Unicorn-54014.exe	46
PID 2348 wrote to memory of 2168	2348	Unicorn-54014.exe	46
PID 2348 wrote to memory of 2168	2348	Unicorn-54014.exe	46

C:\Users\Admin\AppData\Local\Temp\b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe
"C:\Users\Admin\AppData\Local\Temp\b75447851e9bbe8e9ffca6708ef5517808896ae6bf695c96ba998ebf6f865473N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
        8⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        9⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        7⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 220
        8⤵
        Program crash
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        7⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        7⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 220
        7⤵
        Program crash
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        7⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        9⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        9⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 240
        9⤵
        Program crash
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        8⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 236
        8⤵
        Program crash
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 220
        8⤵
        Program crash
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        7⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23159.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40675.exe
        7⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37796.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14798.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        6⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14751.exe
        7⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        6⤵
        
        PID:7840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 216
        6⤵
        Program crash
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        5⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        6⤵
        
        PID:8388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 220
        6⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        5⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        5⤵
        
        PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33956.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 240
        6⤵
        Program crash
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        6⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        7⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59401.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        9⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exe
        9⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        9⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        8⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        7⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 240
        7⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        6⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
        7⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        8⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        7⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 240
        7⤵
        Program crash
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        7⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        6⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        5⤵
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        6⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        7⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 236
        7⤵
        Program crash
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44627.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45538.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
        6⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        6⤵
        
        PID:3088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 236
        6⤵
        Program crash
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        5⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        5⤵
        
        PID:9312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        8⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 216
        8⤵
        Program crash
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38207.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        7⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        6⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        7⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 236
        7⤵
        Program crash
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        
        PID:4764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 240
        6⤵
        Program crash
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        6⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        7⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 240
        7⤵
        Program crash
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4144.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        6⤵
        
        PID:4972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 236
        6⤵
        Program crash
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        5⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        6⤵
        
        PID:3512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 236
        6⤵
        Program crash
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        5⤵
        
        PID:4952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 216
        5⤵
        Program crash
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57688.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        6⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38882.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47499.exe
        7⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
        6⤵
        
        PID:4928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 236
        6⤵
        Program crash
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        5⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9707.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        6⤵
        
        PID:4876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 240
        6⤵
        Program crash
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
        5⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
        6⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
        5⤵
        
        PID:4912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 220
        5⤵
        Program crash
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        6⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        5⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        5⤵
        
        PID:9008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9008 -s 148
        6⤵
        
        PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        5⤵
        
        PID:4164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 240
        5⤵
        Program crash
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
      4⤵
      PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
      4⤵
      PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      4⤵
      PID:9588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        6⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        7⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        8⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 240
        8⤵
        Program crash
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19328.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        7⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49785.exe
        6⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        7⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        6⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        5⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22161.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        6⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39412.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14638.exe
        5⤵
        
        PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe
        5⤵
        
        PID:3160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 240
        5⤵
        Program crash
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      4⤵
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        5⤵
        
        PID:3116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 236
        5⤵
        Program crash
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
      4⤵
      PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        5⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23417.exe
        6⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44569.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        5⤵
        
        PID:7848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 216
        5⤵
        Program crash
        
        PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
        5⤵
        
        PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
      4⤵
      PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
      4⤵
      PID:8728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        5⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        6⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        5⤵
        
        PID:3944
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 240
        5⤵
        Program crash
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49785.exe
      4⤵
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        5⤵
        
        PID:5076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 240
        5⤵
        Program crash
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30515.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
      4⤵
      PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
      4⤵
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
      4⤵
      PID:9540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
    3⤵
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
      4⤵
      PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
      4⤵
      PID:10116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
    3⤵
    PID:7276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
    3⤵
    PID:10220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10276.exe
        7⤵
        
        PID:9524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 216
        6⤵
        Program crash
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59401.exe
        6⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        6⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13411.exe
        6⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        5⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15131.exe
        5⤵
        
        PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57688.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 220
        5⤵
        Program crash
        
        PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        5⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        6⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        7⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 220
        7⤵
        Program crash
        
        PID:6664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 236
        6⤵
        Program crash
        
        PID:3624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 236
        5⤵
        Program crash
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        6⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        5⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        5⤵
        
        PID:8372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
      4⤵
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        5⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        5⤵
        
        PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        6⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        7⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        8⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        8⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 220
        8⤵
        Program crash
        
        PID:6200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 236
        7⤵
        Program crash
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        7⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        6⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        5⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        6⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45473.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        7⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
        6⤵
        
        PID:4044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 240
        6⤵
        Program crash
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        6⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        6⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        5⤵
        
        PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        7⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        6⤵
        
        PID:7888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 216
        6⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        5⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48083.exe
        6⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34921.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        5⤵
        
        PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
      4⤵
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        5⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
        6⤵
        
        PID:8232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 236
        6⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        5⤵
        
        PID:8136
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 216
        5⤵
        Program crash
        
        PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
      4⤵
      PID:10052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
        5⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
        6⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        7⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        6⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        6⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        5⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
      4⤵
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        6⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        5⤵
        
        PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 220
        5⤵
        Program crash
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47973.exe
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
      4⤵
      PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43496.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe
      4⤵
      PID:9972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
      4⤵
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        5⤵
        
        PID:4920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 240
        5⤵
        Program crash
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
      4⤵
      PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38551.exe
    3⤵
    PID:916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 220
      4⤵
      Program crash
      PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
    3⤵
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
      4⤵
      PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20432.exe
      4⤵
      PID:8720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 220
      4⤵
      PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
    3⤵
    PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
    3⤵
    PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
    3⤵
    PID:7916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
    3⤵
    PID:8736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26861.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        8⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
        7⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 216
        7⤵
        Program crash
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
        6⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        7⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        6⤵
        
        PID:6696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 236
        6⤵
        Program crash
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56355.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        7⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 236
        7⤵
        Program crash
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35611.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        6⤵
        
        PID:7936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 236
        6⤵
        Program crash
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        6⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        5⤵
        
        PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
        7⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        6⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        5⤵
        
        PID:6084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 240
        5⤵
        Program crash
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19983.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1003.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        6⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        5⤵
        
        PID:3648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 240
        5⤵
        Program crash
        
        PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
      4⤵
      PID:448
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 220
        5⤵
        Program crash
        
        PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
      4⤵
      PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13937.exe
      4⤵
      PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54128.exe
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      4⤵
      PID:9272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        6⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34725.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        7⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        6⤵
        
        PID:4712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 236
        6⤵
        Program crash
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        5⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:4344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 240
        6⤵
        Program crash
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        5⤵
        
        PID:3792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 236
        5⤵
        Program crash
        
        PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
      4⤵
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        5⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        6⤵
        
        PID:4980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 240
        6⤵
        Program crash
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        5⤵
        
        PID:8396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 240
        5⤵
        
        PID:9432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exe
      4⤵
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exe
        5⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exe
        5⤵
        
        PID:7812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 240
        5⤵
        Program crash
        
        PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
      4⤵
      PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        5⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        6⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        5⤵
        
        PID:8088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 216
        5⤵
        Program crash
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
      4⤵
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59560.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        5⤵
        
        PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
      4⤵
      PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
      4⤵
      PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
    3⤵
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
      4⤵
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        5⤵
        
        PID:9500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
      4⤵
      PID:2744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 236
      4⤵
      PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30779.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
      4⤵
      PID:9292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exe
    3⤵
    PID:6640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
    3⤵
    PID:7752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
    3⤵
    PID:8460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15332.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        5⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        6⤵
        
        PID:4892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 240
        6⤵
        Program crash
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
        5⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        6⤵
        
        PID:5900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 220
        6⤵
        Program crash
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        5⤵
        
        PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        5⤵
        
        PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
      4⤵
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        6⤵
        
        PID:9376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 216
        5⤵
        Program crash
        
        PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        5⤵
        
        PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
      4⤵
      PID:9028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        5⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36083.exe
        6⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
        5⤵
        
        PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
      4⤵
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        5⤵
        
        PID:8872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 220
      4⤵
      Program crash
      PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
    3⤵
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35011.exe
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        5⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        5⤵
        
        PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
      4⤵
      PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
      4⤵
      PID:7208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 236
      4⤵
      Program crash
      PID:8300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
    3⤵
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exe
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 236
      4⤵
      Program crash
      PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
    3⤵
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 236
    3⤵
    - Program crash
    PID:7184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49240.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        5⤵
        
        PID:2644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 220
        6⤵
        Program crash
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        5⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
        6⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        5⤵
        
        PID:9612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 236
      4⤵
      Program crash
      PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        5⤵
        
        PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
      4⤵
      PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
      4⤵
      PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
      4⤵
      PID:9324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
    3⤵
    PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exe
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9863.exe
    3⤵
    PID:7532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
    3⤵
    PID:9296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
    3⤵
    - Executes dropped EXE
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32510.exe
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        5⤵
        
        PID:7960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 220
        5⤵
        Program crash
        
        PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
      4⤵
      PID:8064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 236
      4⤵
      PID:8864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    3⤵
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
      4⤵
      PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
      4⤵
      PID:9400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
    3⤵
    PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
    3⤵
    PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    3⤵
    PID:8216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 220
    3⤵
    - Program crash
    PID:2328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
    3⤵
    PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
    3⤵
    PID:7976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 216
    3⤵
    PID:9316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
  2⤵
  PID:3128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
  2⤵
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42611.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42611.exe
  2⤵
  PID:7088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
  2⤵
  PID:7684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
  2⤵
  PID:8440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe

Filesize
468KB

MD5
a0168b9cb4cbc8717c630506b191de4e

SHA1
c0a87143133ab53ca38fcbea7f11cbe8d25f48f5

SHA256
d7eb34b92376cd668916a374104ac70278bff2eb77717819e03b87d74fafbf12

SHA512
6ba9bd17a14aa8879ae0061f43945db6633bf7e8753cc10516973459f319d5497353c5559cd5a91d5970d022dc3e142af768a0e711e8318e3c508c5b44647240

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe

Filesize
468KB

MD5
8e6862ab8376a58ff73c699c98cdc870

SHA1
31fdab6cae0e20f6f38a8093f0c44badba7b1b3b

SHA256
a1dbc97c1935841c1c1ea98cce4dae1d5a2b9cb1758a26cd5d260448135720e3

SHA512
b138cec254295d01b45074fbdfc83c497ac0b89c333886c2cfc7e69651e72a162971436016f3295a9edbfae1c962aac00f7a33ba601c0a366c8e1fea5d1345c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe

Filesize
468KB

MD5
8013948084adb0fdee5ea9c95d113d5e

SHA1
2625e6373f1efc8cdcc889853f84fa3599e5fc84

SHA256
a4a3053be28671561aa611b8edea66cf150794f5f8510a95049bd96cfd78f5e2

SHA512
b2a8812f23911ba3023bb7eca71148be9c03a9c0accf647f481e7750bcb2bc3d0b5be6cfbacf143a7c4174f96647e920617fd9585c8e1e063e473d86b561b791

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe

Filesize
468KB

MD5
83de8c4d66cbef5db8718f92ac5fc43d

SHA1
bc3097cce5efc1d03a2dac28ddc0792b8cfc5c81

SHA256
b7edb1a73a80d0f0c753802fe02db7245009ea9ca95958213707f131f41e1385

SHA512
ce7c9ddc773a25c4ad90a40fbd52b336214008188a6692ed99bf0939961201185a230af7945273c31ad41643727bb8155800153786d2a8596054438d105b34e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe

Filesize
468KB

MD5
ae398f71db94d17dfe1cc0f0765da4db

SHA1
5ab378c38f7e69f50dc33420fddcce0e38c1e514

SHA256
a31806de9cae897f3cf6d0c3e441e98517066ccf3935916638f493079f31d0bb

SHA512
2a28bbd699e796445f31a6c9594aabbd33aaf35afa012bdaa74ccb0a34cece1f45685c4fd3e6b050b4d2ec5595d3e5806bfd5e72502f59cbc123c0457881eef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe

Filesize
468KB

MD5
19329f491f9e5ef8f7c7252d33451f43

SHA1
28ba5187b332dcdc54f1f1133e11bf269963398e

SHA256
5129f60d9e4e426d526e65ce911ab735c262577f5c21141f62ed990fa1c996d7

SHA512
ff30aac242f8b5733ac37cea42caa021c66d118f2d81382054bd60692d878b2e7acf7efb3f14c029a4a774adf73cada3d57dee17b839f8de7833d222ffc5e0b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe

Filesize
468KB

MD5
5b9e5ab4e394215d36cc91edb23b7130

SHA1
4f467b66f3cccd32a023232ed7acbd47d199b0a3

SHA256
bedf7305d87f0f0daf0e79c2cb10ff0dae380e3b14fa82af9c92027780ee970d

SHA512
492c4c8a77fe7f4fdf8bf57e06e1a5c9788acec26b65f5cb878892e0b1a39bc9a14039eff5e953722c90601b61e382394233c98bd5d4480e8f6e552f2a038186

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe

Filesize
468KB

MD5
9c08cf4c01c129131feb63493513b02c

SHA1
e17b65b7139fb5f5273c5c2e69222321d1ed7699

SHA256
e67e94e7e79c757a39a05b0c95a38552291398f1edfd6609e4cc14670534f6eb

SHA512
21987052d2bab4128569636cfec7ea0335598bc49b70443654f3b7f4173e2877f7875a989029e8f61b01ed18ccce3fbb66ba287eefcfa9bc236846d1867ccfb0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15332.exe

Filesize
468KB

MD5
22affee04ebd7e6e40de9bb57456be98

SHA1
b61ca06dd2b110448ba9cee349d45630af5b485e

SHA256
cca445446b53fc6ce154e2b49fbd5326b578228898ba2a0e6973579b2e074a99

SHA512
17655df82c1fa56de618c9dce1ed7390d201b515f8d8fc4ea860a63b7035c0e6ce9331f7c80cd978fdf6d80d2fb1d7810b94aa13e90b965aae43d84a3f06c9db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe

Filesize
468KB

MD5
cca807f7d77de8a5e3dfe94072332c56

SHA1
838442963f7a71f78003dd835ffc9b943e72126c

SHA256
72c3d4f56cd56b063caedbb1694885bf2de09cefefd53a79e1110c79942a470a

SHA512
2d1ecddc54ed46672a6160950c3417e42aab08d11cbce580d4cb303ad2b22d4b7ac7e3e53b6ad13b8890d3cd5aa58ae9568264566fadfaba4cffcd73b90d1a71

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe

Filesize
468KB

MD5
1ab91348298eb3df7e31bc1702a21dd9

SHA1
f11e3f28a3ee26d26a354553b12223f6c52cef1c

SHA256
81b709d69c8c3767c7ae943ff1cd2834db4c9e4e3c6139677a2bc0324a84dbe9

SHA512
ab581bfdd41d1818cb593bd20d8c8c22a0dcee185cc3187963b89f72168fda4d1051a0c236ec5fb4fb097094e14522e191fa9de82a66e84030d86d303ef13281

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe

Filesize
468KB

MD5
4d2d72c39b86a8f6a8e7349ee840f295

SHA1
008441360c8285a6e6e068ff054898062ef9d35c

SHA256
d24585b01de58418660dd7cc08f985bb4042e74327e67a07028220a389e4dbef

SHA512
42c568ef27d1b7794899fd594a8843cdd58dee9dd425f850ebc3971a9e53552bcf560c6cdecf9915e59f073dd0a9c50f76841ac637c398652e1b7e668cd31652

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe

Filesize
468KB

MD5
93c03e553dd69c6ae0d2535cf38473cc

SHA1
39a6973cf9fa1bb5376e28cfff6f8d2262142815

SHA256
e9ae43c3734355b2189b38b83d588425d4cbf6b9f44c039182d726a466a89b03

SHA512
578a8da519d26ccbfece232021414720c501d4a1c83603ed5877e24e6adde626f56f9229160af029abd3f7bec56ae938a4f1fe3ad271eac2a63b628c0804ace8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33956.exe

Filesize
468KB

MD5
be709bb434b857303ea42c21832d48f5

SHA1
f83b1e62acd99781d13ca0ab120c109922fa8a09

SHA256
fde393d84accdecfdd814c68005fbd0ecf836cf1b986a633615fb57fde1b7a16

SHA512
c0976da76f9fdb1a768590fae12ec66e8fed47017e796505057488905ea6efe4e4924c85d837b95efb49c2157cb3438aa2a8b1b27257dbffe9a70bddbee801c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe

Filesize
468KB

MD5
2e467320adfe03e55d02dc5eea4cc49b

SHA1
32c696a8c7e650c21bf41f65bbdb8d7158392286

SHA256
f4b8bca6e94620c77b6ce1d1c2e39b8a009c5fccf6903028394092b032953d34

SHA512
c257a0c3eeaee87959d431c49cfcc5133276bdf5f83df0c51ed075fa58998f84e599783da145ac873a77114b5ed27f80c003c20e254737f6a513110e7c7fc448

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe

Filesize
468KB

MD5
0c782c1511ced690b09d7fa2056dd124

SHA1
c7b4948c091572e75131457501f0781441b23de2

SHA256
9f048ffc10110c4779d3321b5a4294fe2ba8976e56ecedf35eae514a1d971e4f

SHA512
a24e600874c5b85a9747859d1fde67f94d7cbec1c039470f34d71b36210e4832e173acf8d28e41373c3725960f9587b7f0de469edda47108ba7f2361519be9f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe

Filesize
468KB

MD5
3f9db139c60aba27352ce2bd31356bf5

SHA1
0290ca90efa8a0d1d9caf6e85b01e750293e1d8d

SHA256
bcbfb30193461e57abc3f62b152d50a63df91e4b63f012690d349db9323900d9

SHA512
f1b26c4c4d029637f56d9d62c67267ff41f7e5ca067d6a367dfb05794f9c8019ab4e37294f6f21f0eb8b8ebab68f3b12997f1e872ff0fb527013240aa2ea44a2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe

Filesize
468KB

MD5
0f64b73da4a05e6037c3e432e5c5e52e

SHA1
cf794652ca76c784bdd20373cd93ad305a0adb0f

SHA256
dfa28f36008481b3c2f44ae228586be4b6c39fcd9bff7b05dcf980b48bc895e9

SHA512
2e595657ce7114139692ef5626e227147442066b979d8bd4bc4f2f7d56eb225e05467034bc6aa5c73f89ce5bde5b2d22d0e15abc4c4ac6b469aca73426a31c92

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe

Filesize
468KB

MD5
15a6c95eadbfce5dae7a421b7cfeef47

SHA1
e26a92396362fde3e9463a9ca652771ea3121873

SHA256
e0a61110a0c3c144588a3769b1d4f41474a47d80df291db1c7ceef9e2217609c

SHA512
937215873e4e806faa7a038d2244224b2d57732821bcc8965ead419840f027dc52da06797d3fbb624db8dc0ae157f1255085dcc8e1bb0a3e94832f0a03f644d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe

Filesize
468KB

MD5
75c7495787cd385fd855f5522a793e4b

SHA1
9e0ad730c874727d1bac779f1191a81cb547917d

SHA256
74a0e94540af01b7cba7c3d013a641989a3e2dcdf02fd7d82eba4f2856ad290e

SHA512
7645040f0b74e825768fba2366f624e7a849cdeb06dadbcc928c64a3661c2b03fe2ea65a6c3b32744323713f00c849c2791a17a9b80dadbec6f7c1f69cd6e599

Download Submit
memory/540-131-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/540-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-47-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/1040-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-368-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/1088-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-372-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/1112-411-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/1112-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-255-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/1232-253-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/1232-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-288-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1592-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-285-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1620-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-224-0x00000000031B0000-0x0000000003225000-memory.dmp

Filesize
468KB

Download
memory/1872-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-225-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/1896-312-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1896-308-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1896-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-70-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2120-423-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2120-10-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2120-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-356-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2120-230-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2120-11-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2120-360-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2120-234-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2168-333-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2168-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-331-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2264-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-393-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2324-306-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2324-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-25-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2324-171-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2324-167-0x0000000001E40000-0x0000000001EB5000-memory.dmp

Filesize
468KB

Download
memory/2324-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-196-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2348-343-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2348-197-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2348-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-347-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2572-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-165-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2604-299-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2604-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-170-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2684-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-386-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2692-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-245-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2716-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-82-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2732-269-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2732-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-267-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2732-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-173-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2732-166-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2768-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-169-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2840-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-304-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2852-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-377-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2852-96-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2852-210-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2852-211-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2932-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-287-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/3008-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-276-0x00000000027A0000-0x0000000002815000-memory.dmp

Filesize
468KB

Download
memory/3008-272-0x00000000027A0000-0x0000000002815000-memory.dmp

Filesize
468KB

Download
memory/3024-286-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/3024-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-293-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download