df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07

Analysis

max time kernel
96s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe
Size

468KB
MD5

3d569e3a2bfee52b6d162fe6da5b9520
SHA1

15cc766dc01ed18f9054245070a1caf28c2c702b
SHA256

df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07
SHA512

98c98295e6d9983a61578cafff6190ec1a55301da6182be7f0a7a943b2553db656dbebb5a3e93c0c4b53f603f9d9feffbc1aea5dcbe0d350d6c312071c48104a
SSDEEP

3072:mrp7ogKxjz8UFbYWPz3yqf8/Eptj7PpgPmHx+lOvElM0Ac71SDlk:mrpotAUF1PDyqf/BtlEl1J71S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
940	Unicorn-23447.exe
3540	Unicorn-41489.exe
2768	Unicorn-61355.exe
4732	Unicorn-48885.exe
696	Unicorn-3860.exe
2988	Unicorn-54915.exe
4900	Unicorn-8407.exe
4268	Unicorn-39539.exe
1600	Unicorn-58568.exe
4540	Unicorn-46301.exe
2120	Unicorn-11490.exe
4864	Unicorn-1276.exe
2268	Unicorn-7141.exe
2284	Unicorn-54469.exe
2724	Unicorn-6015.exe
880	Unicorn-62227.exe
1272	Unicorn-50530.exe
4644	Unicorn-25279.exe
3028	Unicorn-6804.exe
4396	Unicorn-41515.exe
4388	Unicorn-2720.exe
1296	Unicorn-43561.exe
440	Unicorn-55548.exe
2888	Unicorn-21003.exe
4304	Unicorn-37431.exe
4100	Unicorn-31309.exe
4844	Unicorn-7359.exe
5020	Unicorn-39477.exe
4044	Unicorn-57189.exe
3920	Unicorn-42169.exe
4752	Unicorn-19611.exe
540	Unicorn-13986.exe
2144	Unicorn-13986.exe
4784	Unicorn-8432.exe
1040	Unicorn-57925.exe
2920	Unicorn-64147.exe
3108	Unicorn-44282.exe
2092	Unicorn-23669.exe
3064	Unicorn-23669.exe
1804	Unicorn-50141.exe
2220	Unicorn-50141.exe
2200	Unicorn-50141.exe
4392	Unicorn-46057.exe
1924	Unicorn-60447.exe
1740	Unicorn-25445.exe
4276	Unicorn-19314.exe
3776	Unicorn-21095.exe
4352	Unicorn-45957.exe
2128	Unicorn-5579.exe
4860	Unicorn-19969.exe
4624	Unicorn-61631.exe
2816	Unicorn-21361.exe
4824	Unicorn-43819.exe
4508	Unicorn-39570.exe
4848	Unicorn-30083.exe
2108	Unicorn-11801.exe
4364	Unicorn-45095.exe
2276	Unicorn-35559.exe
3644	Unicorn-38827.exe
3560	Unicorn-48387.exe
4996	Unicorn-11630.exe
3940	Unicorn-45050.exe
408	Unicorn-44038.exe
1836	Unicorn-52855.exe

Program crash 30 IoCs

pid	pid_target	Process	procid_target
4108	440	WerFault.exe	116
5156	2268	WerFault.exe	106
5472	4044	WerFault.exe	124
5592	4752	WerFault.exe	122
6180	4644	WerFault.exe	111
3112	4304	WerFault.exe	118
5936	2120	WerFault.exe	104
7160	4844	WerFault.exe	121
6672	5420	WerFault.exe	223
1296	2744	WerFault.exe	163
1588	2108	WerFault.exe	144
3112	372	WerFault.exe	162
5480	6624	WerFault.exe	275
3772	3728	WerFault.exe	315
11624	2392	WerFault.exe	255
11700	3620	WerFault.exe	258
11772	5312	WerFault.exe	217
11780	8040	WerFault.exe	379
3056	6664	WerFault.exe	250
8440	5328	WerFault.exe	666
13844	7980	WerFault.exe	354
14232	6260	WerFault.exe	237
15156	3644	WerFault.exe	154
15216	3236	WerFault.exe	171
5492	4608	WerFault.exe	308
15496	3080	WerFault.exe	428
15980	8796	WerFault.exe	414
15968	9488	WerFault.exe	528
7980	10864	WerFault.exe	586
2004	8736	WerFault.exe	411

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34106.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe
940	Unicorn-23447.exe
3540	Unicorn-41489.exe
2768	Unicorn-61355.exe
4732	Unicorn-48885.exe
696	Unicorn-3860.exe
4900	Unicorn-8407.exe
2988	Unicorn-54915.exe
4268	Unicorn-39539.exe
1600	Unicorn-58568.exe
4864	Unicorn-1276.exe
4540	Unicorn-46301.exe
2268	Unicorn-7141.exe
2724	Unicorn-6015.exe
2120	Unicorn-11490.exe
2284	Unicorn-54469.exe
880	Unicorn-62227.exe
1272	Unicorn-50530.exe
3028	Unicorn-6804.exe
4644	Unicorn-25279.exe
4388	Unicorn-2720.exe
4396	Unicorn-41515.exe
2888	Unicorn-21003.exe
3920	Unicorn-42169.exe
4044	Unicorn-57189.exe
5020	Unicorn-39477.exe
4752	Unicorn-19611.exe
4304	Unicorn-37431.exe
4100	Unicorn-31309.exe
440	Unicorn-55548.exe
1296	Unicorn-43561.exe
4844	Unicorn-7359.exe
540	Unicorn-13986.exe
2144	Unicorn-13986.exe
4784	Unicorn-8432.exe
1040	Unicorn-57925.exe
3108	Unicorn-44282.exe
2920	Unicorn-64147.exe
3064	Unicorn-23669.exe
2092	Unicorn-23669.exe
1804	Unicorn-50141.exe
4392	Unicorn-46057.exe
2200	Unicorn-50141.exe
2220	Unicorn-50141.exe
1924	Unicorn-60447.exe
4276	Unicorn-19314.exe
3776	Unicorn-21095.exe
2128	Unicorn-5579.exe
4860	Unicorn-19969.exe
4352	Unicorn-45957.exe
4824	Unicorn-43819.exe
4508	Unicorn-39570.exe
1740	Unicorn-25445.exe
2816	Unicorn-21361.exe
4624	Unicorn-61631.exe
2276	Unicorn-35559.exe
2108	Unicorn-11801.exe
4364	Unicorn-45095.exe
4848	Unicorn-30083.exe
4996	Unicorn-11630.exe
3560	Unicorn-48387.exe
3644	Unicorn-38827.exe
408	Unicorn-44038.exe
3940	Unicorn-45050.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 940	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	91
PID 1364 wrote to memory of 940	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	91
PID 1364 wrote to memory of 940	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	91
PID 1364 wrote to memory of 3540	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	94
PID 1364 wrote to memory of 3540	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	94
PID 1364 wrote to memory of 3540	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	94
PID 940 wrote to memory of 2768	940	Unicorn-23447.exe	93
PID 940 wrote to memory of 2768	940	Unicorn-23447.exe	93
PID 940 wrote to memory of 2768	940	Unicorn-23447.exe	93
PID 3540 wrote to memory of 4732	3540	Unicorn-41489.exe	97
PID 3540 wrote to memory of 4732	3540	Unicorn-41489.exe	97
PID 3540 wrote to memory of 4732	3540	Unicorn-41489.exe	97
PID 1364 wrote to memory of 696	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	98
PID 1364 wrote to memory of 696	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	98
PID 1364 wrote to memory of 696	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	98
PID 2768 wrote to memory of 2988	2768	Unicorn-61355.exe	99
PID 2768 wrote to memory of 2988	2768	Unicorn-61355.exe	99
PID 2768 wrote to memory of 2988	2768	Unicorn-61355.exe	99
PID 940 wrote to memory of 4900	940	Unicorn-23447.exe	100
PID 940 wrote to memory of 4900	940	Unicorn-23447.exe	100
PID 940 wrote to memory of 4900	940	Unicorn-23447.exe	100
PID 4732 wrote to memory of 4268	4732	Unicorn-48885.exe	101
PID 4732 wrote to memory of 4268	4732	Unicorn-48885.exe	101
PID 4732 wrote to memory of 4268	4732	Unicorn-48885.exe	101
PID 3540 wrote to memory of 1600	3540	Unicorn-41489.exe	102
PID 3540 wrote to memory of 1600	3540	Unicorn-41489.exe	102
PID 3540 wrote to memory of 1600	3540	Unicorn-41489.exe	102
PID 696 wrote to memory of 4540	696	Unicorn-3860.exe	103
PID 696 wrote to memory of 4540	696	Unicorn-3860.exe	103
PID 696 wrote to memory of 4540	696	Unicorn-3860.exe	103
PID 4900 wrote to memory of 2120	4900	Unicorn-8407.exe	104
PID 4900 wrote to memory of 2120	4900	Unicorn-8407.exe	104
PID 4900 wrote to memory of 2120	4900	Unicorn-8407.exe	104
PID 940 wrote to memory of 4864	940	Unicorn-23447.exe	105
PID 940 wrote to memory of 4864	940	Unicorn-23447.exe	105
PID 940 wrote to memory of 4864	940	Unicorn-23447.exe	105
PID 1364 wrote to memory of 2268	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	106
PID 1364 wrote to memory of 2268	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	106
PID 1364 wrote to memory of 2268	1364	df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe	106
PID 2988 wrote to memory of 2284	2988	Unicorn-54915.exe	107
PID 2988 wrote to memory of 2284	2988	Unicorn-54915.exe	107
PID 2988 wrote to memory of 2284	2988	Unicorn-54915.exe	107
PID 2768 wrote to memory of 2724	2768	Unicorn-61355.exe	108
PID 2768 wrote to memory of 2724	2768	Unicorn-61355.exe	108
PID 2768 wrote to memory of 2724	2768	Unicorn-61355.exe	108
PID 4268 wrote to memory of 880	4268	Unicorn-39539.exe	109
PID 4268 wrote to memory of 880	4268	Unicorn-39539.exe	109
PID 4268 wrote to memory of 880	4268	Unicorn-39539.exe	109
PID 4732 wrote to memory of 1272	4732	Unicorn-48885.exe	110
PID 4732 wrote to memory of 1272	4732	Unicorn-48885.exe	110
PID 4732 wrote to memory of 1272	4732	Unicorn-48885.exe	110
PID 1600 wrote to memory of 4644	1600	Unicorn-58568.exe	111
PID 1600 wrote to memory of 4644	1600	Unicorn-58568.exe	111
PID 1600 wrote to memory of 4644	1600	Unicorn-58568.exe	111
PID 2724 wrote to memory of 3028	2724	Unicorn-6015.exe	112
PID 2724 wrote to memory of 3028	2724	Unicorn-6015.exe	112
PID 2724 wrote to memory of 3028	2724	Unicorn-6015.exe	112
PID 4864 wrote to memory of 4388	4864	Unicorn-1276.exe	113
PID 4864 wrote to memory of 4388	4864	Unicorn-1276.exe	113
PID 4864 wrote to memory of 4388	4864	Unicorn-1276.exe	113
PID 2768 wrote to memory of 4396	2768	Unicorn-61355.exe	114
PID 2768 wrote to memory of 4396	2768	Unicorn-61355.exe	114
PID 2768 wrote to memory of 4396	2768	Unicorn-61355.exe	114
PID 2120 wrote to memory of 1296	2120	Unicorn-11490.exe	115

C:\Users\Admin\AppData\Local\Temp\df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe
"C:\Users\Admin\AppData\Local\Temp\df6f2da393959945b3e269ce89951887e3c473ed48a3bb0876a6a945f8bfdc07N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57925.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52855.exe
        8⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        9⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        10⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        11⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        11⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 632
        11⤵
        Program crash
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        10⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        10⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        10⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        9⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        10⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        9⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        10⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        11⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        10⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        10⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        9⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        9⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        9⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        7⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        9⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        9⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        9⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        9⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 656
        8⤵
        Program crash
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
        9⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        9⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        9⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        8⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        7⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        9⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        10⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        10⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        9⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        9⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        10⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        9⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        9⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
        10⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        9⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe
        9⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        8⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19468.exe
        8⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        9⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        9⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        9⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63199.exe
        8⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        7⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        7⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 544
        7⤵
        Program crash
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-684.exe
        9⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        7⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        8⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        8⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
        8⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43574.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
        8⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        7⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        6⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39615.exe
        7⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15905.exe
        9⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe
        8⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
        8⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        8⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59910.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        7⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57826.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 752
        7⤵
        Program crash
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        6⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
        7⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        6⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        6⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54118.exe
        5⤵
        
        PID:8736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8736 -s 628
        6⤵
        Program crash
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        9⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        10⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        10⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        9⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        9⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41885.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50637.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        9⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        9⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        8⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18134.exe
        7⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36907.exe
        6⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        7⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35344.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        8⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        9⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7496.exe
        8⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        8⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        7⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40694.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        6⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
        6⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        7⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        6⤵
        
        PID:9968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6260 -s 748
        6⤵
        Program crash
        
        PID:14232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        7⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        6⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8796 -s 632
        7⤵
        Program crash
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        6⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17071.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
        5⤵
        
        PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 640
        7⤵
        Program crash
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58565.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        6⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6703.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        5⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        6⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
      4⤵
      PID:5420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 632
        5⤵
        Program crash
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30701.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
      4⤵
      PID:13260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8407.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        9⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 632
        10⤵
        Program crash
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        9⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53687.exe
        9⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
        9⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        8⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        9⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        8⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        9⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        7⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11801.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        8⤵
        
        PID:15944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 632
        7⤵
        Program crash
        
        PID:8440
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 628
        6⤵
        Program crash
        
        PID:1588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 664
        5⤵
        Program crash
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        9⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
        9⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        8⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        8⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55241.exe
        7⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        6⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        7⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        6⤵
        
        PID:12604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 752
        5⤵
        Program crash
        
        PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        8⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        8⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        7⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        7⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        6⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28625.exe
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        6⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16895.exe
        7⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        6⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21225.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        6⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
        5⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        5⤵
        
        PID:12732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
      4⤵
      PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45777.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        9⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        9⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        9⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        8⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        8⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        8⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        8⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        7⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        7⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        9⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        7⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15508.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44167.exe
        6⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39951.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3386.exe
        7⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30143.exe
        6⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        6⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        6⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        5⤵
        
        PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        7⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        6⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        5⤵
        
        PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53893.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        5⤵
        
        PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
      4⤵
      PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        5⤵
        
        PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
      4⤵
      PID:9364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
      4⤵
      PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 720
      4⤵
      Program crash
      PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        5⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
      4⤵
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        5⤵
        
        PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
      4⤵
      PID:8532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
    3⤵
    PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        5⤵
        
        PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      4⤵
      PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      4⤵
      PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
      4⤵
      PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
    3⤵
    PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
      4⤵
      PID:10292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
    3⤵
    PID:9924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
    3⤵
    PID:13216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
    3⤵
    PID:14892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41489.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41489.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        9⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        10⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        10⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        10⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        9⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        10⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
        9⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        9⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
        9⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        9⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe
        9⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14976.exe
        8⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        9⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        9⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18850.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        8⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28170.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        8⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        7⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9488 -s 640
        8⤵
        Program crash
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        7⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        7⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        8⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        7⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        7⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        7⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        6⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38793.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
        6⤵
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44282.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        9⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        9⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        8⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 736
        7⤵
        Program crash
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        6⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8040 -s 632
        7⤵
        Program crash
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        6⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        5⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        9⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        8⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        7⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe
        7⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18964.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        6⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5162.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        7⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        6⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        5⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        5⤵
        
        PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50530.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        8⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        9⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47928.exe
        9⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        9⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        9⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        9⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10864 -s 648
        9⤵
        Program crash
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        8⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        8⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2775.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        6⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37315.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        7⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        6⤵
        
        PID:12408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 748
        6⤵
        Program crash
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        6⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        6⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27777.exe
        6⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18842.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        5⤵
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41885.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        8⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        9⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32115.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        8⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18134.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        8⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        6⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14202.exe
        7⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        6⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        6⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        5⤵
        
        PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        7⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        6⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 636
        7⤵
        Program crash
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        6⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        5⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        6⤵
        
        PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65051.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        6⤵
        
        PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
      4⤵
      PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        5⤵
        
        PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
      4⤵
      PID:15192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        6⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
        8⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        8⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        7⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
        5⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        7⤵
        
        PID:15844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 752
        5⤵
        Program crash
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        5⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54648.exe
        7⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        7⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:12444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 636
        6⤵
        Program crash
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        7⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7980 -s 648
        7⤵
        Program crash
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        6⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        5⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
        6⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        6⤵
        
        PID:8356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 656
        6⤵
        Program crash
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57772.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63986.exe
      4⤵
      PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        5⤵
        
        PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
      4⤵
      PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63649.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38145.exe
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        6⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38905.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        6⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15290.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        5⤵
        
        PID:2920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 664
      4⤵
      Program crash
      PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
      4⤵
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        5⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        6⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        5⤵
        
        PID:12060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7106.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      4⤵
      PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        5⤵
        
        PID:15864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
    3⤵
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      4⤵
      PID:11244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
    3⤵
    PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
      4⤵
      PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    3⤵
    PID:12000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1469.exe
    3⤵
    PID:15380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        5⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
        6⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60398.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39376.exe
        6⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7385.exe
        5⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        6⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        5⤵
        
        PID:13176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        6⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
        5⤵
        
        PID:13000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 632
      4⤵
      Program crash
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        6⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        5⤵
        
        PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        5⤵
        
        PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
      4⤵
      PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
    3⤵
    PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        5⤵
        
        PID:13104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
    3⤵
    PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
      4⤵
      PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      4⤵
      PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
    3⤵
    PID:10060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
    3⤵
    PID:12752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10696.exe
    3⤵
    PID:15016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 744
    3⤵
    - Program crash
    PID:5156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 632
    3⤵
    - Program crash
    PID:5472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exe
    3⤵
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
      4⤵
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        5⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        5⤵
        
        PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
      4⤵
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        5⤵
        
        PID:15924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
    3⤵
    PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
      4⤵
      PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
      4⤵
      PID:15416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10796.exe
    3⤵
    PID:10136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
    3⤵
    PID:13296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
    3⤵
    PID:15232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
  2⤵
  PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
    3⤵
    PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
      4⤵
      PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
      4⤵
      PID:7412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 664
    3⤵
    - Program crash
    PID:3056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
  2⤵
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
    3⤵
    PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
      4⤵
      PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
    3⤵
    PID:12136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
    3⤵
    PID:12596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
  2⤵
  PID:8964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
  2⤵
  PID:11488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3423.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3423.exe
  2⤵
  PID:14676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 440 -ip 440
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2268 -ip 2268
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4752 -ip 4752
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4044 -ip 4044
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5020 -ip 5020
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4100 -ip 4100
1⤵
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2220 -ip 2220
1⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4392 -ip 4392
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2120 -ip 2120
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4844 -ip 4844
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4304 -ip 4304
1⤵
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4644 -ip 4644
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2200 -ip 2200
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4276 -ip 4276
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2920 -ip 2920
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1804 -ip 1804
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1296 -ip 1296
1⤵
PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5844 -ip 5844
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5420 -ip 5420
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2744 -ip 2744
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2108 -ip 2108
1⤵
PID:7272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 372 -ip 372
1⤵
PID:7380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4508 -ip 4508
1⤵
PID:7488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4540 -ip 4540
1⤵
PID:7320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1040 -ip 1040
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5744 -ip 5744
1⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4352 -ip 4352
1⤵
PID:8648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6576 -ip 6576
1⤵
PID:8876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6244 -ip 6244
1⤵
PID:8988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6624 -ip 6624
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5328 -ip 5328
1⤵
PID:8996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6664 -ip 6664
1⤵
PID:8448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3728 -ip 3728
1⤵
PID:9112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6528 -ip 6528
1⤵
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6552 -ip 6552
1⤵
PID:8944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6216 -ip 6216
1⤵
PID:9364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5716 -ip 5716
1⤵
PID:9488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2528 -ip 2528
1⤵
PID:9496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6516 -ip 6516
1⤵
PID:9544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6164 -ip 6164
1⤵
PID:9764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2920 -ip 2920
1⤵
PID:10120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 440 -ip 440
1⤵
PID:9256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2232 -ip 2232
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5408 -ip 5408
1⤵
PID:9904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1836 -ip 1836
1⤵
PID:8572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2392 -ip 2392
1⤵
PID:9936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5472 -ip 5472
1⤵
PID:10404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6396 -ip 6396
1⤵
PID:10988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5500 -ip 5500
1⤵
PID:11052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5312 -ip 5312
1⤵
PID:11164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3620 -ip 3620
1⤵
PID:9284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8040 -ip 8040
1⤵
PID:11560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 7916 -ip 7916
1⤵
PID:11640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5912 -ip 5912
1⤵
PID:12752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5896 -ip 5896
1⤵
PID:12760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5792 -ip 5792
1⤵
PID:12876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5456 -ip 5456
1⤵
PID:12972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2612 -ip 2612
1⤵
PID:13092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 408 -ip 408
1⤵
PID:13188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4624 -ip 4624
1⤵
PID:13236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3776 -ip 3776
1⤵
PID:13252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6504 -ip 6504
1⤵
PID:13280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6012 -ip 6012
1⤵
PID:11596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6536 -ip 6536
1⤵
PID:10688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2276 -ip 2276
1⤵
PID:12124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5280 -ip 5280
1⤵
PID:11536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4000 -ip 4000
1⤵
PID:11228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5684 -ip 5684
1⤵
PID:10960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5496 -ip 5496
1⤵
PID:12080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 7980 -ip 7980
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5764 -ip 5764
1⤵
PID:12932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5952 -ip 5952
1⤵
PID:13412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6260 -ip 6260
1⤵
PID:13420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2656 -ip 2656
1⤵
PID:13836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7644 -ip 7644
1⤵
PID:14092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5692 -ip 5692
1⤵
PID:14124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7728 -ip 7728
1⤵
PID:14152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 7216 -ip 7216
1⤵
PID:14176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7408 -ip 7408
1⤵
PID:14204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6572 -ip 6572
1⤵
PID:14240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 7032 -ip 7032
1⤵
PID:14252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5540 -ip 5540
1⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 544 -ip 544
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3236 -ip 3236
1⤵
PID:14836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3644 -ip 3644
1⤵
PID:14892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3940 -ip 3940
1⤵
PID:14980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5460 -ip 5460
1⤵
PID:9476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1384 -ip 1384
1⤵
PID:12172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3608 -ip 3608
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4848 -ip 4848
1⤵
PID:15088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6224 -ip 6224
1⤵
PID:15132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5512 -ip 5512
1⤵
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5528 -ip 5528
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2768 -ip 2768
1⤵
PID:12792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5128 -ip 5128
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1272 -ip 1272
1⤵
PID:15640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4268 -ip 4268
1⤵
PID:15708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4608 -ip 4608
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 7852 -ip 7852
1⤵
PID:9628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7736 -ip 7736
1⤵
PID:16116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6940 -ip 6940
1⤵
PID:16260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 7636 -ip 7636
1⤵
PID:14732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 9488 -ip 9488
1⤵
PID:15428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 8796 -ip 8796
1⤵
PID:5624

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:15860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 10864 -ip 10864
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8736 -ip 8736
1⤵
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8356 -ip 8356
1⤵
PID:4748

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:12508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6436 -ip 6436
1⤵
PID:12004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe

Filesize
468KB

MD5
f332cfa076e37b6da1dbb8c7ed291bb0

SHA1
b6d1591efb1f685dfcd5968684b24f304fb73a34

SHA256
515a6e04dbee0d16c52664e4f46d7929c8ab897a6eed2ff004937a244ec1df3c

SHA512
5db1bfb54b8d655eea85209f3b2eccd62c48d3f8f7e879783324afe2537fb5ee32bb08000b0697a5309d8464c68797a0e200d6bcd724265abb39a1f0691d5b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe

Filesize
468KB

MD5
4a3368681b6d75f445636bfe80aa7629

SHA1
c1c1edd16d8760ee06dd3c55c0f42e5c34907094

SHA256
ea15d772b6e9f1f7b443b64ffa83633c4647b5f0888c7718da131a1b94998632

SHA512
6f454804b665dec89e54dc56856a9787c32cea6d83f52ff444784b4e7529acfa8659738232eff6138f6bf003ce52e04b85d596d09d836b784cf012629d1e1738

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe

Filesize
468KB

MD5
da6d69fb50e108f0e4233f946054e516

SHA1
d4b120f66212d0d7ea818f8c23be2c067d353c36

SHA256
673b6cf9fb22ede838f3625ac67b46238a0389464a65163a2fc908041cca5212

SHA512
545d6827378fdb4b8606a8044e886f9f22f033e186a501b3fe19bb2454d30e17ca6a1aa235e9296c363609e3244dda3e79aaf1c7e0f5e60f88fb3358db5b2501

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe

Filesize
468KB

MD5
db8e72b62efa874733f7282d8724a726

SHA1
5351c0ef99b3dcb79f999500733705b7ab58b202

SHA256
e8884bdc64eb93fab18b4dbba3001f260644b4426aff6c9d4fc006c02f304541

SHA512
8669a7563132fd1a06184491f5427413747da0f6eda96899845bacd566235b82c1ab378614ce590cd80460224715e4db7a57f26551861d9f64eaa369b4fc9661

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe

Filesize
468KB

MD5
7a70fb89fde2d3caab60d6d580d7438e

SHA1
cccfcd4d161c9a62a72006b94fce98931471c36a

SHA256
00ece13c56a2b1cdef0d394ec2227cebd438dbba7301d653ef2b32ffca3898ce

SHA512
0a18dee9112ca0abd27c26562320f6c353a941579029406d064cbfe3c0eca4e417fd23eb9432e06d77ce8298f67254161723c7d890d6719fff56a0261b1255d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe

Filesize
468KB

MD5
5d63839508d6f6104832067815d4c78a

SHA1
d87e9a76e66d97d941c3378993e442f5751f38c6

SHA256
810ded350ffba93a692b812fe2e2a3a9d857e854d520860e324b8969bd6d42d1

SHA512
169f13d542067457f8da746e25bd6dd15f4b3cb96948b5d1555b81fc6da4a5d066a4a8ca1f3c39a7df4958843c787bb98c271f8eb2036bc3ad985879e9a6bd16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe

Filesize
468KB

MD5
d32f20ae49deaf319042e135a1132f06

SHA1
06001abc3863bad88958c27be5b17013ab89deb9

SHA256
405ed5fb955d93cec1fd034efa87c63134831725c32ca0b7b6a02947576764b2

SHA512
8d1f4daa1a9a38be560610c7a7fbf616df6137871d368e15d6d178e84732e7cb9fa3c1e669cc2ad5a2405141f39ad13a56b477a81ba6f71611e6049ac8f6f4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe

Filesize
468KB

MD5
78bbcd5e123601c3712900815b9dffd0

SHA1
e992e013a1b31d04fc98f44621552adbc437c725

SHA256
9af89860f6c753de37994ef37476984faf4d394b3d30e241b594785ec166d5e8

SHA512
3d9561b457796968123662be2919c86a4d36119febce1fded2020d885aa937508f6c008c13bbc410e23ce591fc55513e4cd58998fba43a833768f3cffb35c467

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe

Filesize
468KB

MD5
f855721f340d27e9ccf603ac493b543b

SHA1
879d99f191cdf89b9e83316656bad1fbe633af2c

SHA256
f787e0c8360bafa59fcf8e77d4433475bf26a255dbacf79dbf833fbb206ae567

SHA512
d711a9c96493e8728f40046077ece27a4c2e690f5324f59d002866bc1d52ed13f428482788466228b4d3d8889d4e2c2e4f24e64088ccaea10ca565082d670057

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe

Filesize
468KB

MD5
0b0ee714adce118617a36a6f124a6a76

SHA1
36f49e3b4569be791d5188696a287fb4fe10c8f4

SHA256
56debe8ca7c045f7445d6a0617d653f682ee3642beb6c671a4346adb64000597

SHA512
d7c0d9bd2a737fb3911a7e3cbf767b576ce3b6041d36befb763747d60efff86a5e2b9e1b1cafec99800b8aceb4d5aad7157bc5358e1f29b268a569797698148c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe

Filesize
468KB

MD5
5758f11198a2af681530dcd2497bff43

SHA1
ac00671014756f292a81d21b0d8c0bb5086ce3f7

SHA256
780f316d1c930c95fc22c0b81fcfd29fac964f733d38bd9515ddd5f0aeb64108

SHA512
e300748450afed45eec7fd13cade37a338ed108dff2457cfeeac2bfd59ef0d1028fca8c0f345dc341ca7ec0964a3deda92378101b98c5138116670cb77fc0c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe

Filesize
468KB

MD5
d37584d6ce9df871f3420fbcec566f0e

SHA1
bce630d9b956853a54fa64fd9d095caead895a03

SHA256
44a928366f1d34fe9499f9747b63d380ad9ac5313b28875b3915f916caf498b9

SHA512
9589288ce54e11b426cdb4cd8e7639c7bddaf3d3b4ce614f9ac94aef68bde9bec4a5770415a5a48597c06c9c430470a267348277e1af2c46bd27f1de8c3598fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe

Filesize
468KB

MD5
87bcb0474facb45695f99726607c0a00

SHA1
63321073cb9af3be64f19643e32f48fcb9ae5737

SHA256
72fe85819a5d38da7a1a23a0b07b20dfa8da654e40d921b35f2e34705790fab9

SHA512
af8c446e9b25882db175c7906a262e5c4ae092b9368589aaa11ae6feb8a418461ef145f3be1ee56a38b922ad024bc476488ae5cf7db130bf507fc30f24d8b3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe

Filesize
468KB

MD5
03243d6f54f3b3266b351e6ab0c80bb8

SHA1
8331ec791f378024e9c92fbebd92690174c6e24c

SHA256
040d94fdfbafac6c0c8c7acaaebf55076420f6bd545b25e32c946e85610ffa3e

SHA512
e2805a20d76653ec325e26df2a92b766bf49956c3a854b3a477676197d837aa71df98504e84d399985fa44fde4c0b34ab591cf0cbe154c88e08020725f2659ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39951.exe

Filesize
468KB

MD5
2f9e81ac117a3da111e172aed5873f65

SHA1
5d94c26d3e3d01914e3ddb07a7879927cd98b3fc

SHA256
b12ceb95ed536621e446d3b47a53044e1479d9a1dd56b3d5c73a2ab6372ead2a

SHA512
34fc941e190859a0975497971943ca63b641da582316d7ae477b2d17775dc41cd0899ae4b1d08bd5eebfc20a52b6618403f6b434513864dc416fee1c5eb5f025

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41489.exe

Filesize
468KB

MD5
f6462b6edaa01093e8dce50541f62dd3

SHA1
ec0727e29fc190483516e2a131c7f686978ee5a8

SHA256
41ce0f00cf853bedddec7b397f561b2ba247df72115b8f6367513c5f8ad8010a

SHA512
4972337836f77557713fed24777439acaccc8db02d692f8082690cad0038f27ca4518fff296dc5a33f0cf6aa15696a37d668ac580ee3386012474b172c064465

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe

Filesize
468KB

MD5
1033de7ea538c9aeb69a000879d84d37

SHA1
994c1b50a36848af91a47110c0aba35560f0678c

SHA256
990af3f49ed5eb4099510f75d88805e210e5f3456567fef57bc28c100ff9b75b

SHA512
e8fdb624e88779264e1981292cd6bde0e838c057551be06dbbbf9bbc00502ae377a42e6b63ee910a0abcc9d106d8f86cc69cfcc96ff379fe2d44e19e179cd299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe

Filesize
468KB

MD5
bd0e8564b55b0eee48a81f9cae92cfe4

SHA1
cb047effcccb7146f90456aacc43c8dff2c1c666

SHA256
9243585fb5d28f027383d940f25496b7b19d9a997159c8ee9c739aa09145a13a

SHA512
74b33ebbe76464a36a8e4c3d4f6766bef68780372174fac3d764af8b557688c6562a0a56e222fd88e1f9a8d1412cc618814af0a99ac59ec111c6b673c20e6ba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe

Filesize
468KB

MD5
fe4e12711b5128872d8f2d0fcad90f57

SHA1
6619503bf3b198f4b1233dfa2932235a6521bae6

SHA256
01ff9a8411f93dc935bd6ded1c32b1f3917c01fa25ec4727323b86e2467ae3c5

SHA512
a59f9e76fc3a7bfd060c1eebaaf9c6bdc39382ae77c3be588a54811d8a1d252da253cdfccca8e3084757c296101429eceb69ffc13ed25446224618cedb702a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe

Filesize
468KB

MD5
f70d8f97f95a388c82645d7a3d1b1be4

SHA1
2ba4b84debdd369d127aba52cb0909710ad3a7ec

SHA256
ea34fb5f42454d698521696a0a39419eecb8d54779ed1bb2bb0d73b00780bd75

SHA512
6c5312bcf31e0c511f88aebcb02aa3f407a9d6eeded3938eb255daf30b9f3dd2ea36159d3191215759340124451af7dda46e44540385ae7b439e4c49415ebaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe

Filesize
468KB

MD5
e669ee0ed28a80ad542971357accf0a9

SHA1
3a0b55ec3d27e0964f0aab27bb00652fade5e769

SHA256
6c77d2d8f92093192f74af9ecd724edb38a6c2a976091bf46b754fa717025b6e

SHA512
51b723891cdeea3af9f70ddfb8af1fdfc001f258737251eaf50abd79a09c8311eee9b8a9f0f5675897f56d1ad231952b7c5ff270f6eb4aca30f3b69f2c7ae762

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50530.exe

Filesize
468KB

MD5
e92464665cedefaa319f65ad92c2a1e2

SHA1
4bc9bda01b28fbcaeb42520d906e25953e8aaafa

SHA256
875cc9f460a0d4b518bcdb1856e2d07aaddc8ee6983a92aff1ca4b0ec126fc8d

SHA512
d2e0928c80fe9bd495f72735f1107a09beabdbac178f03d9447a64ebf582cbd21f3fb4c19f5e0b3f7cc08248def2d31948df0d65440337db6815a39354ad9919

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe

Filesize
468KB

MD5
11bbd7438ed781fdf5877a23365dd862

SHA1
7550703bd6f99a148e8f3d01bb0e21d84ed1afed

SHA256
54aa28c8bdff451628446cd2a460a2aeb29c4af3dc1c81e1457c5d21525ae9f2

SHA512
4ba2f9b8bfe8dfb67320fdf5d30e950c63a84d4618c719c5d77371903a4c5b0a7b205f9efbd52815bc0ffbe955c53414c98c7b588c30d1356b59e042dd637cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54915.exe

Filesize
468KB

MD5
b00b3bde8d73de14a91a3af307c84b23

SHA1
7a547c83fe59a48c85a1b0d27bb7227e7111cb45

SHA256
5b8bfecae67a91e6e47d77959a6140f969af49d567ce02856551368a3280a4ad

SHA512
513552ef7f052fc3b499aa445ee61dc7dc5f1548d7c6d4404092fcce8510325828366e5e850105ebf03e1c483b1aca122ba272b781f4fc7fcca70b78aaee3f11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe

Filesize
468KB

MD5
aeb9f0c81b0d9b4f38a22f1b98d6d461

SHA1
49b62e8676a5b9bb46d137b6af1dcfe45a4174f8

SHA256
a6e051ada589ade1be7f7b78e804bfd7ab6afb9880d24cb98365d72302695431

SHA512
ff512d4933edf7a1b181aaedd1f1b953d57d77e3ca71d0a73230212c194d7cfeec4cb763c1d1b18a6dac1e65df2008dcdd7b79e00c9b80ee37eeaf65c3df038a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe

Filesize
468KB

MD5
047f2d51563b4cc11903faee71a71e79

SHA1
5b39f736a97505f6b2173d5697ebbd65510701e4

SHA256
5bfa9106bb637308f5a2db65ed79536e55e9757c241a1b96fa0195600aec409f

SHA512
cd9200fb78b16b23bb1a2915b977f1a0aae78db78931f9ca7d42dac37e14772302a4086e3996ec9bf652f5900eec0b81e82142cbefa1de4b6bfebdc4f0ba2476

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe

Filesize
468KB

MD5
1966c65f6ce55bffd8029f41d2db1fda

SHA1
8096fdf51373afe67c5fb11a7e7cd883397cf501

SHA256
14984701dacdc52ba2a0a9c75945a00dfe8098b5c6dbb391ff336aa93d29e836

SHA512
2e63058af9f444155080eb0e53b8824824acae754f8013030f33aadbe4c4b618188bc0c25d225066bdc1a43d5d4833944724dd4e50fdbb6fbfcc8f855affd5eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe

Filesize
468KB

MD5
84bf9d73e3c5719605ec8e3e7655f7b7

SHA1
330b5701408833b5a262c9361e6f198a8ae8f466

SHA256
d3ac0bb2af6ddc1036b3a48b0cefab4d6ca31adedd4c6a31e99a5cd148cc3db4

SHA512
e13b5fbea9421bd6588e64ab8349ba00d99d7a7350e94674751f8e63fd7f79f74150c2a6f7470a6c2ef5e79d3aa5763b867b80808cb13cf1e043460c100c4db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60398.exe

Filesize
468KB

MD5
6ece822e5127f27cd4f5ad5876e90732

SHA1
a6c0e3bc6861242512e769f54cb7a0d032384918

SHA256
10b33ae3edbce64e84e5669225cdc4e1b6ca4321d1340ceafc59324b15d2e66d

SHA512
29cb2bb24c854d5611e2777ab171f424f9f32e887408375185ef216907b5172cb8f7a08369647a00c0132eb167151866acba07f7d6252ff7a65719df66ba767f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe

Filesize
468KB

MD5
f1b10a19b21e4538f816dd32511ee213

SHA1
62c2190dcd497f0d01a05facacb7192177950dfa

SHA256
1118febdb3c54f362df64403209bf19aaa510a0fd5e274dac6ca84cfd46a0ed1

SHA512
1c50144cd3ca8556eb79cc568a09aef62fbe1617eb2bb15877ffb470deba1a0032e357cc57920ffe1a46f3e06200a0282dc97aea80c3ed381e90bf45bf812b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe

Filesize
468KB

MD5
dfcaf21119227ac25f93e13f6d0deaee

SHA1
5208c4935ff4a192f1f56f841e7974903fc8f1db

SHA256
069a02a83b9682b4dca56dd1e453bc0bea2d7443355c8e0ca9d3164eb6754f72

SHA512
e42b6312bf6d37a908a5c0944bc3b393a4340717784b182af7918388f059af1dcdca8d1849b46903d2662ab3c157cab7d321f67cd20fa1bf870795a066588a13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe

Filesize
468KB

MD5
25070c303764dc5578d548a4a8fc16b1

SHA1
54309c7c4f1ed5cdd6abfd8c6a6da94a2c3b1335

SHA256
9a99801b79409621b42b495df10bf6b35f2f58554021afb461b4218b4aba8126

SHA512
f94469b24b4fb56e2c4ac946b7ad0558266ba0f03b6e0b286b3c08ef0d41a1afa8ab53938b1519f7707a38030e0c6b25d7b65ceb64d4c08aa62e453e6cbf58d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe

Filesize
468KB

MD5
267530125863cd7489bf93dbbb6499e5

SHA1
60e0a4699e923d4045d72b6d8b4d87230d3a4d15

SHA256
8e67732882b500edfc8bb9ff2771ea70fdfed52bc32e8ef9e2b7e3600c1e5b93

SHA512
70fdafb6bdaf13ab0af96df07f202bb2ba308e4e750419ba1e73b10d00a1b30326cfa175855df3b7f5e572e96566a9b8cb001398e3d5f6a79d2094159b7fbc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe

Filesize
468KB

MD5
62c7071c6e186194be1e34f937bb6bcf

SHA1
b4ddde58d71ce59db9f44bfef6cb999b68f31715

SHA256
bf6cdca00b30b3ef9da3df1ca9bed46a80195aad947ba3c36e8689a860f2eb6b

SHA512
af32a6e366cbffd176b6035862dd61864af07acbce40cf7dda23e63856904dc80768d3ac9703af5cbb9aa202fdbce427763fa32126b8b7df0de3c44127b28d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8407.exe

Filesize
468KB

MD5
d7119199da3dc6d9729bfa95b597571e

SHA1
b8e2d8bbadd7fbc495531cd88ea6477731c40998

SHA256
551a0adbebb374756533db9960a05797c9f87f497437ff86df40c92f426b34a7

SHA512
840b0da8aef6b5ed82ef8e6f0fed5b63458d8d35d231f995db4d7ea5733137626d12eadc39c5712c8c590d289c6ad8d4d69ea61f59b747e5f46b4acc2dc9693d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe

Filesize
468KB

MD5
88151b2603dfa8d832f1c6305ba1b7fa

SHA1
dad32b94ab5e2a44b8cd490fd56ef6ed652e8fce

SHA256
b57d8fae5cd2873f9a5fe56936af4b453a2684b789a1906833bc6acb55aef02e

SHA512
23560c54bf1fa3247116e4e0075cdca81ec10f45fbd90c1d3f8b2ba1b4ed4cb26f7d431d291804831f6ada541352d77d801b45b7aabd0144adb8cf103b2b1da5

Download Submit
memory/320-2991-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/372-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1272-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1296-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-3090-0x00007FFF91CD0000-0x00007FFF91EC5000-memory.dmp

Filesize
2.0MB

Download
memory/1600-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-17-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5528-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5732-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5756-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5768-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5784-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5844-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5876-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5884-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5896-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5904-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5996-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6036-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6124-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download