3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14

Analysis

max time kernel
118s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe
Size

468KB
MD5

8e3e39309d5777ed0660f43643f71040
SHA1

d7710123e9dceda61ba8762074b6eb3b24b60487
SHA256

3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14
SHA512

a622f70e43df55d072168c3420cc6be62827d032f1951aef966d23ccecd991568fc8e69581a89f2e925f9768b776649c16eeceb655f9874ef49873a39c8795b5
SSDEEP

3072:mrz7ogKxjz8UFbYWPz3yqf8/Eptj7PpgPmHx+lXvEln0Aco1Salk:mrfotAUF1PDyqf/BtSEl0Jo1S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3652	Unicorn-55582.exe
2988	Unicorn-62894.exe
3420	Unicorn-59749.exe
3112	Unicorn-31382.exe
3040	Unicorn-27852.exe
3408	Unicorn-11838.exe
668	Unicorn-16891.exe
916	Unicorn-13286.exe
4776	Unicorn-13286.exe
5116	Unicorn-13478.exe
2980	Unicorn-59150.exe
4300	Unicorn-7348.exe
4764	Unicorn-62165.exe
3516	Unicorn-16228.exe
632	Unicorn-29654.exe
4428	Unicorn-9980.exe
788	Unicorn-11309.exe
3572	Unicorn-59725.exe
3280	Unicorn-18518.exe
3604	Unicorn-34589.exe
948	Unicorn-34854.exe
1164	Unicorn-64511.exe
1716	Unicorn-4027.exe
2308	Unicorn-35046.exe
4528	Unicorn-15180.exe
1588	Unicorn-26878.exe
3456	Unicorn-44838.exe
4260	Unicorn-1419.exe
4976	Unicorn-56270.exe
2420	Unicorn-40230.exe
1380	Unicorn-6388.exe
2228	Unicorn-61143.exe
4224	Unicorn-61143.exe
5108	Unicorn-3893.exe
3192	Unicorn-49685.exe
4392	Unicorn-50391.exe
1128	Unicorn-29094.exe
4960	Unicorn-61004.exe
5052	Unicorn-22846.exe
3232	Unicorn-2980.exe
4840	Unicorn-14677.exe
3828	Unicorn-27229.exe
4420	Unicorn-32829.exe
2760	Unicorn-11662.exe
2312	Unicorn-61055.exe
3300	Unicorn-571.exe
668	Unicorn-11854.exe
2124	Unicorn-33213.exe
3960	Unicorn-61247.exe
1632	Unicorn-61247.exe
1156	Unicorn-52565.exe
1564	Unicorn-6893.exe
3844	Unicorn-31869.exe
2396	Unicorn-51470.exe
376	Unicorn-45605.exe
1712	Unicorn-60479.exe
4924	Unicorn-18251.exe
4460	Unicorn-8237.exe
4928	Unicorn-49742.exe
3088	Unicorn-3805.exe
4116	Unicorn-4070.exe
2468	Unicorn-32358.exe
4796	Unicorn-58486.exe
1092	Unicorn-12814.exe

Program crash 42 IoCs

pid	pid_target	Process	procid_target
1452	668	WerFault.exe	88
1384	1128	WerFault.exe	128
6156	4744	WerFault.exe	174
6636	1692	WerFault.exe	157
6620	2468	WerFault.exe	153
1752	1156	WerFault.exe	142
7604	4924	WerFault.exe	148
7316	4796	WerFault.exe	154
7796	5800	WerFault.exe	212
7788	4528	WerFault.exe	115
4796	5544	WerFault.exe	199
9120	5172	WerFault.exe	190
7512	4904	WerFault.exe	179
8520	5476	WerFault.exe	196
13036	5268	WerFault.exe	194
13068	5636	WerFault.exe	202
12884	5256	WerFault.exe	193
12868	5228	WerFault.exe	191
1628	4008	WerFault.exe	288
14236	7768	WerFault.exe	361
11448	1852	WerFault.exe	289
14452	7384	WerFault.exe	341
892	6428	Process not Found	270
5984	7828	Process not Found	364
2892	2420	Process not Found	121
16032	3512	Process not Found	459
5444	7848	Process not Found	472
11776	9112	Process not Found	430
15732	8616	Process not Found	418
916	3408	Process not Found	87
7740	5720	Process not Found	209
11480	11880	Process not Found	718
4652	5116	Process not Found	95
5752	2988	Process not Found	83
7876	4392	Process not Found	127
8688	7244	Process not Found	400
8776	7456	Process not Found	346
7464	6620	Process not Found	308
9676	3764	Process not Found	300
6732	3192	Process not Found	126
1128	6168	Process not Found	264
6256	6396	Process not Found	268

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5326.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe
3652	Unicorn-55582.exe
2988	Unicorn-62894.exe
3420	Unicorn-59749.exe
3112	Unicorn-31382.exe
3040	Unicorn-27852.exe
668	Unicorn-16891.exe
3408	Unicorn-11838.exe
916	Unicorn-13286.exe
5116	Unicorn-13478.exe
2980	Unicorn-59150.exe
4764	Unicorn-62165.exe
3516	Unicorn-16228.exe
4300	Unicorn-7348.exe
4776	Unicorn-13286.exe
4428	Unicorn-9980.exe
788	Unicorn-11309.exe
3572	Unicorn-59725.exe
1164	Unicorn-64511.exe
3604	Unicorn-34589.exe
3280	Unicorn-18518.exe
4260	Unicorn-1419.exe
2308	Unicorn-35046.exe
948	Unicorn-34854.exe
4528	Unicorn-15180.exe
3456	Unicorn-44838.exe
1716	Unicorn-4027.exe
1588	Unicorn-26878.exe
4976	Unicorn-56270.exe
2420	Unicorn-40230.exe
1380	Unicorn-6388.exe
4224	Unicorn-61143.exe
2228	Unicorn-61143.exe
5108	Unicorn-3893.exe
3192	Unicorn-49685.exe
4392	Unicorn-50391.exe
1128	Unicorn-29094.exe
4960	Unicorn-61004.exe
5052	Unicorn-22846.exe
4840	Unicorn-14677.exe
3232	Unicorn-2980.exe
2760	Unicorn-11662.exe
4420	Unicorn-32829.exe
3828	Unicorn-27229.exe
2312	Unicorn-61055.exe
2124	Unicorn-33213.exe
668	Unicorn-11854.exe
1156	Unicorn-52565.exe
1564	Unicorn-6893.exe
3844	Unicorn-31869.exe
3300	Unicorn-571.exe
376	Unicorn-45605.exe
1632	Unicorn-61247.exe
3960	Unicorn-61247.exe
2396	Unicorn-51470.exe
4924	Unicorn-18251.exe
1712	Unicorn-60479.exe
4460	Unicorn-8237.exe
3088	Unicorn-3805.exe
4116	Unicorn-4070.exe
4928	Unicorn-49742.exe
2468	Unicorn-32358.exe
4796	Unicorn-58486.exe
1692	Unicorn-55767.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3652	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	82
PID 2136 wrote to memory of 3652	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	82
PID 2136 wrote to memory of 3652	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	82
PID 3652 wrote to memory of 2988	3652	Unicorn-55582.exe	83
PID 3652 wrote to memory of 2988	3652	Unicorn-55582.exe	83
PID 3652 wrote to memory of 2988	3652	Unicorn-55582.exe	83
PID 2136 wrote to memory of 3420	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	84
PID 2136 wrote to memory of 3420	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	84
PID 2136 wrote to memory of 3420	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	84
PID 2988 wrote to memory of 3112	2988	Unicorn-62894.exe	85
PID 2988 wrote to memory of 3112	2988	Unicorn-62894.exe	85
PID 2988 wrote to memory of 3112	2988	Unicorn-62894.exe	85
PID 3652 wrote to memory of 3040	3652	Unicorn-55582.exe	86
PID 3652 wrote to memory of 3040	3652	Unicorn-55582.exe	86
PID 3652 wrote to memory of 3040	3652	Unicorn-55582.exe	86
PID 3420 wrote to memory of 3408	3420	Unicorn-59749.exe	87
PID 3420 wrote to memory of 3408	3420	Unicorn-59749.exe	87
PID 3420 wrote to memory of 3408	3420	Unicorn-59749.exe	87
PID 2136 wrote to memory of 668	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	88
PID 2136 wrote to memory of 668	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	88
PID 2136 wrote to memory of 668	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	88
PID 3112 wrote to memory of 916	3112	Unicorn-31382.exe	93
PID 3112 wrote to memory of 916	3112	Unicorn-31382.exe	93
PID 3112 wrote to memory of 916	3112	Unicorn-31382.exe	93
PID 3040 wrote to memory of 4776	3040	Unicorn-27852.exe	94
PID 3040 wrote to memory of 4776	3040	Unicorn-27852.exe	94
PID 3040 wrote to memory of 4776	3040	Unicorn-27852.exe	94
PID 3408 wrote to memory of 5116	3408	Unicorn-11838.exe	95
PID 3408 wrote to memory of 5116	3408	Unicorn-11838.exe	95
PID 3408 wrote to memory of 5116	3408	Unicorn-11838.exe	95
PID 2988 wrote to memory of 2980	2988	Unicorn-62894.exe	96
PID 2988 wrote to memory of 2980	2988	Unicorn-62894.exe	96
PID 2988 wrote to memory of 2980	2988	Unicorn-62894.exe	96
PID 3652 wrote to memory of 4300	3652	Unicorn-55582.exe	97
PID 3652 wrote to memory of 4300	3652	Unicorn-55582.exe	97
PID 3652 wrote to memory of 4300	3652	Unicorn-55582.exe	97
PID 3420 wrote to memory of 4764	3420	Unicorn-59749.exe	99
PID 3420 wrote to memory of 4764	3420	Unicorn-59749.exe	99
PID 3420 wrote to memory of 4764	3420	Unicorn-59749.exe	99
PID 2136 wrote to memory of 3516	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	98
PID 2136 wrote to memory of 3516	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	98
PID 2136 wrote to memory of 3516	2136	3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe	98
PID 916 wrote to memory of 632	916	Unicorn-13286.exe	104
PID 916 wrote to memory of 632	916	Unicorn-13286.exe	104
PID 916 wrote to memory of 632	916	Unicorn-13286.exe	104
PID 3112 wrote to memory of 4428	3112	Unicorn-31382.exe	105
PID 3112 wrote to memory of 4428	3112	Unicorn-31382.exe	105
PID 3112 wrote to memory of 4428	3112	Unicorn-31382.exe	105
PID 4764 wrote to memory of 788	4764	Unicorn-62165.exe	106
PID 4764 wrote to memory of 788	4764	Unicorn-62165.exe	106
PID 4764 wrote to memory of 788	4764	Unicorn-62165.exe	106
PID 3420 wrote to memory of 3572	3420	Unicorn-59749.exe	107
PID 3420 wrote to memory of 3572	3420	Unicorn-59749.exe	107
PID 3420 wrote to memory of 3572	3420	Unicorn-59749.exe	107
PID 4300 wrote to memory of 3280	4300	Unicorn-7348.exe	108
PID 4300 wrote to memory of 3280	4300	Unicorn-7348.exe	108
PID 4300 wrote to memory of 3280	4300	Unicorn-7348.exe	108
PID 3652 wrote to memory of 3604	3652	Unicorn-55582.exe	109
PID 3652 wrote to memory of 3604	3652	Unicorn-55582.exe	109
PID 3652 wrote to memory of 3604	3652	Unicorn-55582.exe	109
PID 2980 wrote to memory of 948	2980	Unicorn-59150.exe	110
PID 2980 wrote to memory of 948	2980	Unicorn-59150.exe	110
PID 2980 wrote to memory of 948	2980	Unicorn-59150.exe	110
PID 5116 wrote to memory of 1164	5116	Unicorn-13478.exe	111

C:\Users\Admin\AppData\Local\Temp\3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe
"C:\Users\Admin\AppData\Local\Temp\3053a936a6c289b0f8528610ba025a25aaaef12d5f74d7b6e0b70eae4151da14N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        6⤵
        Executes dropped EXE
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60479.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        9⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        10⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        11⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23093.exe
        11⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        11⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        11⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exe
        10⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        10⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        10⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43332.exe
        10⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        9⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        10⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        10⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        9⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14973.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        9⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        10⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        10⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        9⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        9⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
        9⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        8⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        9⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
        9⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        8⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        8⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38164.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exe
        8⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        9⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        9⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exe
        9⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        8⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        9⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        9⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        9⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        9⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        9⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        8⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 636
        7⤵
        Program crash
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        9⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        8⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        8⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        7⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 660
        7⤵
        Program crash
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        6⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        9⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
        10⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        11⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        11⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
        12⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        11⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42293.exe
        10⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        10⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64181.exe
        10⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        9⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        9⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        9⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        9⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29373.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        9⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51087.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        9⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        9⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34021.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
        9⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        8⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        8⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        8⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
        8⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        7⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37631.exe
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        8⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        8⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        8⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        7⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        7⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        9⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        10⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        10⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        9⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        9⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        9⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        9⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        9⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        8⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        7⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29373.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        8⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        7⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17227.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8677.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        7⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
        8⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
        9⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
        9⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        8⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 656
        8⤵
        Program crash
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        7⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        7⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        6⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        7⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        6⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        6⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        5⤵
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        9⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        9⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        9⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        9⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34021.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        8⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        8⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        8⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        7⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
        8⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        7⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 636
        6⤵
        Program crash
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        6⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        7⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        6⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11909.exe
        5⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        6⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        5⤵
        
        PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        8⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 660
        7⤵
        Program crash
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38652.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        7⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 632
        6⤵
        Program crash
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7054.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        8⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        8⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        7⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        6⤵
        
        PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        5⤵
        
        PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
      4⤵
      PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        5⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        5⤵
        
        PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
      4⤵
      PID:10780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
      4⤵
      PID:14144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
      4⤵
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55295.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        10⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        10⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        9⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52916.exe
        9⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        9⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        8⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
        8⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31183.exe
        9⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25806.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exe
        7⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        7⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
        6⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
        9⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        8⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        8⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
        7⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        6⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        7⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        6⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        7⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        6⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        6⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30710.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
        6⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        7⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        7⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        6⤵
        
        PID:4844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 504
        6⤵
        Program crash
        
        PID:13036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 720
        5⤵
        Program crash
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        8⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        6⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29591.exe
        7⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        5⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        5⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59460.exe
        5⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        5⤵
        
        PID:11660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        6⤵
        
        PID:8408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 624
        5⤵
        Program crash
        
        PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
      4⤵
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35724.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43044.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
      4⤵
      PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
      4⤵
      PID:12260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53996.exe
      4⤵
      PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
        8⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        9⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        9⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        9⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        9⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        8⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        8⤵
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53134.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        9⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        9⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        8⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        7⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10557.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        7⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
        6⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        6⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        5⤵
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        5⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        8⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        7⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        7⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        6⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12750.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        6⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        5⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        5⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        5⤵
        
        PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        6⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        5⤵
        
        PID:7724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 656
        5⤵
        Program crash
        
        PID:12884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23093.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        5⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        6⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
      4⤵
      PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
      4⤵
      PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        6⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        7⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33964.exe
        6⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        7⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        6⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        6⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        6⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        7⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        6⤵
        
        PID:16124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe
      4⤵
      PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        5⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
        5⤵
        
        PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
      4⤵
      PID:14260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        5⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        6⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        5⤵
        
        PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59853.exe
      4⤵
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        5⤵
        
        PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
      4⤵
      PID:11316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
      4⤵
      PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        6⤵
        
        PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
      4⤵
      PID:10636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
    3⤵
    PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
    3⤵
    PID:11404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
    3⤵
    PID:14872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
    3⤵
    PID:7400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59749.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 724
        7⤵
        Program crash
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        9⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        9⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        9⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
        8⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        8⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41677.exe
        7⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        8⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
        7⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
        6⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38591.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        9⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        9⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        9⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        8⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
        9⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        8⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        7⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 644
        6⤵
        Program crash
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        7⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        6⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        6⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9596.exe
        5⤵
        
        PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        8⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        7⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        6⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        7⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        6⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34381.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1941.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        7⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        6⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        6⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        5⤵
        
        PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        5⤵
        
        PID:6024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 504
        5⤵
        Program crash
        
        PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        5⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        5⤵
        
        PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
      4⤵
      PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
      4⤵
      PID:7700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 632
        7⤵
        Program crash
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        8⤵
        
        PID:13400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 636
        7⤵
        Program crash
        
        PID:4796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 624
        6⤵
        Program crash
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        6⤵
        
        PID:11248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 656
        6⤵
        Program crash
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        5⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        5⤵
        
        PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50556.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        5⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe
        6⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        5⤵
        
        PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        6⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe
        7⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        6⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27341.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21540.exe
        5⤵
        
        PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19228.exe
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46493.exe
      4⤵
      PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
        5⤵
        
        PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
      4⤵
      PID:11700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51967.exe
      4⤵
      PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      4⤵
      PID:15876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        7⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        7⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        6⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        7⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        6⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        5⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60877.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
      4⤵
      PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
      4⤵
      PID:14088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 632
        5⤵
        Program crash
        
        PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
    3⤵
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exe
        6⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
        5⤵
        
        PID:15768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
    3⤵
    PID:5848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
    3⤵
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
      4⤵
      PID:10348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
    3⤵
    PID:11324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
    3⤵
    PID:13104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
    3⤵
    PID:15888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 724
    3⤵
    - Program crash
    PID:1452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52607.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        6⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        7⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        6⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        7⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        6⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        6⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-628.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
      4⤵
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        5⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        6⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        5⤵
        
        PID:11900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
      4⤵
      PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        6⤵
        
        PID:1380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 644
        6⤵
        Program crash
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
      4⤵
      PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      4⤵
      PID:14544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        6⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        7⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27156.exe
        6⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
        5⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43855.exe
        6⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        5⤵
        
        PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        5⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        6⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        5⤵
        
        PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
      4⤵
      PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10317.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
      4⤵
      PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
      4⤵
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
      4⤵
      PID:16056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
      4⤵
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        5⤵
        
        PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      4⤵
      PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53030.exe
        5⤵
        
        PID:15924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
      4⤵
      PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
      4⤵
      PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
      4⤵
      PID:1680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
    3⤵
    PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
      4⤵
      PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
    3⤵
    PID:12680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
    3⤵
    PID:12384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
    3⤵
    PID:15440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52607.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
      4⤵
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        5⤵
        
        PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
      4⤵
      PID:11924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
      4⤵
      PID:16112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54013.exe
    3⤵
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        5⤵
        
        PID:12272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 668
      4⤵
      Program crash
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
    3⤵
    PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
      4⤵
      PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        5⤵
        
        PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
      4⤵
      PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
      4⤵
      PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
    3⤵
    PID:12592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16941.exe
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
    3⤵
    PID:5348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        6⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        5⤵
        
        PID:13232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        5⤵
        
        PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41677.exe
      4⤵
      PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
      4⤵
      PID:16160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
    3⤵
    PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
    3⤵
    PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
      4⤵
      PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
      4⤵
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
    3⤵
    PID:12028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
    3⤵
    PID:9096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
    3⤵
    PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
    3⤵
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23804.exe
      4⤵
      PID:11612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 652
      4⤵
      Program crash
      PID:11448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
    3⤵
    PID:464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
  2⤵
  PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
    3⤵
    PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      4⤵
      PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
    3⤵
    PID:6512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
  2⤵
  PID:12896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
  2⤵
  PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 668 -ip 668
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1128 -ip 1128
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1156 -ip 1156
1⤵
PID:5352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2468 -ip 2468
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1692 -ip 1692
1⤵
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3608 -ip 3608
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1888 -ip 1888
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1556 -ip 1556
1⤵
PID:6180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4224 -ip 4224
1⤵
PID:6524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5108 -ip 5108
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2228 -ip 2228
1⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4608 -ip 4608
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4676 -ip 4676
1⤵
PID:6688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2332 -ip 2332
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3764 -ip 3764
1⤵
PID:6772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4744 -ip 4744
1⤵
PID:6832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4104 -ip 4104
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 316 -ip 316
1⤵
PID:7132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 376 -ip 376
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4796 -ip 4796
1⤵
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4924 -ip 4924
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5800 -ip 5800
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4528 -ip 4528
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4428 -ip 4428
1⤵
PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 948 -ip 948
1⤵
PID:7676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 7104 -ip 7104
1⤵
PID:8108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2364 -ip 2364
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2924 -ip 2924
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5652 -ip 5652
1⤵
PID:7268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3232 -ip 3232
1⤵
PID:7572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 392 -ip 392
1⤵
PID:8024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6588 -ip 6588
1⤵
PID:7288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5832 -ip 5832
1⤵
PID:7676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5672 -ip 5672
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6816 -ip 6816
1⤵
PID:7784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1636 -ip 1636
1⤵
PID:8248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5848 -ip 5848
1⤵
PID:8328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5968 -ip 5968
1⤵
PID:8444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5772 -ip 5772
1⤵
PID:8496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5132 -ip 5132
1⤵
PID:8652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2828 -ip 2828
1⤵
PID:8768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5172 -ip 5172
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5544 -ip 5544
1⤵
PID:7340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4904 -ip 4904
1⤵
PID:6520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5476 -ip 5476
1⤵
PID:8872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 1380 -ip 1380
1⤵
PID:9236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5268 -ip 5268
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5228 -ip 5228
1⤵
PID:11468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5636 -ip 5636
1⤵
PID:12412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5256 -ip 5256
1⤵
PID:12672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5240 -ip 5240
1⤵
PID:12788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5156 -ip 5156
1⤵
PID:12928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5712 -ip 5712
1⤵
PID:12964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3960 -ip 3960
1⤵
PID:13008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2396 -ip 2396
1⤵
PID:13048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4116 -ip 4116
1⤵
PID:13060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4460 -ip 4460
1⤵
PID:13096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3844 -ip 3844
1⤵
PID:12656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6864 -ip 6864
1⤵
PID:13432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6756 -ip 6756
1⤵
PID:13576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6712 -ip 6712
1⤵
PID:13688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2312 -ip 2312
1⤵
PID:13896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7440 -ip 7440
1⤵
PID:14048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6328 -ip 6328
1⤵
PID:14112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5892 -ip 5892
1⤵
PID:14244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6408 -ip 6408
1⤵
PID:11956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1564 -ip 1564
1⤵
PID:13220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6884 -ip 6884
1⤵
PID:13520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5924 -ip 5924
1⤵
PID:12912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5680 -ip 5680
1⤵
PID:13140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6312 -ip 6312
1⤵
PID:12916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 8044 -ip 8044
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6500 -ip 6500
1⤵
PID:14440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6636 -ip 6636
1⤵
PID:14756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6804 -ip 6804
1⤵
PID:15064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5976 -ip 5976
1⤵
PID:15240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6380 -ip 6380
1⤵
PID:15284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6560 -ip 6560
1⤵
PID:14184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5496 -ip 5496
1⤵
PID:14200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4960 -ip 4960
1⤵
PID:14208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5148 -ip 5148
1⤵
PID:14312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3860 -ip 3860
1⤵
PID:13088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 8108 -ip 8108
1⤵
PID:14152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1316 -ip 1316
1⤵
PID:14032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 8028 -ip 8028
1⤵
PID:13700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 8000 -ip 8000
1⤵
PID:7444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 8704 -ip 8704
1⤵
PID:13224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 7728 -ip 7728
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 7700 -ip 7700
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7908 -ip 7908
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3484 -ip 3484
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 8568 -ip 8568
1⤵
PID:6764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4236 -ip 4236
1⤵
PID:14528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5140 -ip 5140
1⤵
PID:14616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 7384 -ip 7384
1⤵
PID:15264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7768 -ip 7768
1⤵
PID:6540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1852 -ip 1852
1⤵
PID:14700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4008 -ip 4008
1⤵
PID:12952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7052 -ip 7052
1⤵
PID:15156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3980 -ip 3980
1⤵
PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6528 -ip 6528
1⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4268 -ip 4268
1⤵
PID:15320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6016 -ip 6016
1⤵
PID:14460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5688 -ip 5688
1⤵
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6940 -ip 6940
1⤵
PID:9192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6368 -ip 6368
1⤵
PID:8528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5796 -ip 5796
1⤵
PID:13960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6112 -ip 6112
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4076 -ip 4076
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 7564 -ip 7564
1⤵
PID:14228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6960 -ip 6960
1⤵
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 7472 -ip 7472
1⤵
PID:15152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6064 -ip 6064
1⤵
PID:8692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7548 -ip 7548
1⤵
PID:6540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7596 -ip 7596
1⤵
PID:9664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7836 -ip 7836
1⤵
PID:9196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6852 -ip 6852
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1260 -ip 1260
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 9876 -ip 9876
1⤵
PID:15436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1252 -ip 1252
1⤵
PID:10396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6844 -ip 6844
1⤵
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6136 -ip 6136
1⤵
PID:6540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 7220 -ip 7220
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2808 -ip 2808
1⤵
PID:15700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5696 -ip 5696
1⤵
PID:9664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6772 -ip 6772
1⤵
PID:16288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7740 -ip 7740
1⤵
PID:16296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 7876 -ip 7876
1⤵
PID:11180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6820 -ip 6820
1⤵
PID:9728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6092 -ip 6092
1⤵
PID:12908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 7588 -ip 7588
1⤵
PID:15840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7368 -ip 7368
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8016 -ip 8016
1⤵
PID:16036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1632 -ip 1632
1⤵
PID:15604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5988 -ip 5988
1⤵
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5960 -ip 5960
1⤵
PID:11532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 644 -ip 644
1⤵
PID:11760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 744 -ip 744
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4252 -ip 4252
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 10412 -ip 10412
1⤵
PID:6660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe

Filesize
468KB

MD5
0b6dddf7a1ac98c20cacf9cbc6a44c09

SHA1
154bc01dfec44758d49411407db5447f3e326083

SHA256
0ccf723b646ea6470e599d54018cf07cfb30593910125f9d78412670780494e2

SHA512
63bfdfc9157cf2a8967d157280e4d8429929bbf11a43a9b1921f17817c69ee2dc494318b3ca51f99913a23816d791e0ac644e75524e2e35c55ed32204e05756e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe

Filesize
468KB

MD5
8114a67d0e121238bb81f3e3cdbe1676

SHA1
c0aaee48575d9bc98a27d4c83188435f9a4bee08

SHA256
44191810eea5b2566a94e3be94a28d046640e50202cb73cc0d2cf6c409bbc62b

SHA512
be70d63768dcc9321e733a5f81599c27ea69836ca03a0142cc06d952f570fc08907492171fe86b5fe120d95e76c639aff7a48cf78919b5713ab035aa8c3a8586

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe

Filesize
468KB

MD5
baed2616d68891b7ad2dbd312f54799c

SHA1
f08b8bb1842d5a61e27164c165f54563f9598201

SHA256
1832c756dc731fa87f90ddb18b7b4b64058f1799f243814c16d686b57808f9a7

SHA512
e574167f79db5dd4085175a1e171acdcc785dcc7d349251e5490f5c7b646d836c9c6a8121f7f072fdaeee49f25749ad9b6db58093991b2715799173df8cc5f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe

Filesize
468KB

MD5
67c0aab588f67822ab193de4ccfa4158

SHA1
1358c5c75f5fbb2b50f59b7b941af0f71e8a9a82

SHA256
be238fc0c36cf0ad0ae9a2a5d4b6f5c612ab42c6557f0985e0a30b8aabf418e2

SHA512
b91d34345fc4aed618dbd3c60b439fcada9850bf064d159c7c9af64e13e1eda573ce9257da5a7e0eec91d50743b5fcd55fd23275c5e5b39beedb6e7e738439af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe

Filesize
468KB

MD5
855f3e773ba84f4859be4967d644fb62

SHA1
d111ece8f977608dd8375ffa559879dd51a04add

SHA256
8a69f1545fd229be2760b50fd498db182a16458b74922cdac5c412e9a1c03145

SHA512
b51d2570bc242d3afb24f178d2432d80367831716bfea31a92b5ac56a5c3ba0cdfe6d23fabb19d98512ca950cabc3ffa267cd7672b74f71e2dacb287b76f79a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe

Filesize
468KB

MD5
b0cd97a5a04d7715aba8ac4ec99ee863

SHA1
76173db99b77cd8e8480dd8bbac0e56a51edf47d

SHA256
ba3d629d9d4f3a0454d901d69714e0544686a9aea847dff61b78098f137a85bc

SHA512
b0e2b22f237852488f87433f7f1cb1f63bbda31c87d1500621bc91c898e428ebe5313123fd8695752a5ace3778ed527deaf25fe77ee5eef167ff6af40ee647d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe

Filesize
468KB

MD5
5c4447d15632fa3ebbf755b05935924e

SHA1
da6f367506f5798a5fc4000ba2cd5239e608d642

SHA256
a48a98daf06a39fe8bdd22b1c16fc8dc506b48360f110e9469c3b22e56441304

SHA512
6f3e51b966ef7921db79e48dadc0e459eef4777e5addc9cceaa451f5a4d8cae07895b91a7d59abcffe5c15b189771b858182349cfa473b926ae1e0fc95fd4209

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe

Filesize
468KB

MD5
05e883042067b066f66e786b345baa1b

SHA1
cc9b699c85a349df2219c5269fc254efd58e1c91

SHA256
208bdefa4f7bb64c7a300e32ec29a0eeb224002ea9c32db079ecc66eae87c5e4

SHA512
60ee64e2cfe1229ec91878d7172054684e5e35ec19428b6c027cf8b3ac0ee6f52bde884e128a24418c89ae64d7f6724776d37e3438d65275ec8553b5d9297747

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe

Filesize
468KB

MD5
4cd99b9d96e83d5f7e30b6f2ef1678f5

SHA1
54056efa749a83eea94605bf4228727ba87783b3

SHA256
dbade0cfdfc8ca07a8a6b0ec7b6011e140f8f17a6b82489abeaab9f5153aab62

SHA512
979ae53c0d150215a655ee29151f2ad7654ea36c838aa630fd5dda125ec85ccbd842140f1da6d6d25c85ef402ca5d1c002c5457a239b458bfa6208e0ea20c2da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe

Filesize
468KB

MD5
4a4b33ed0b24c8fe924b7bbb12f8b2f2

SHA1
6383462abd68d281d78fc637bca9e3431279e780

SHA256
2ab9f26c859184b512c7391492284d5421c043d4153e22942ae8a8e3eaf3ed0c

SHA512
d045e65766921aa225d24d90bb2dd90d8a967c687ba387c9592529e13cf66044f12b0cae7bb84e41f0c7eb8e6af5c1dd1fc374492150bf1440182f7ceecd68e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe

Filesize
468KB

MD5
43fec6652e76e483737996e2af29a786

SHA1
9a895260fc465040c19d7b926465e05d986ce622

SHA256
8e84c42d56d9222d20429a1b0269ff593cdfc9b899bd36628325653c7d17a48b

SHA512
5f0eabc0fd93a198108fc8b78340fd62946c33e4517fa5776cf7f3331f0042a262f4af1b563215ea7dc57fdf00cf7c2552829df428a357d392d20b79f8cbc12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe

Filesize
468KB

MD5
183f339cf9267714c5eb2e49c0babc1c

SHA1
61a5b9810a1177bf12d2bf2df3d6b20ec0e62276

SHA256
0aa4763ad53f2fcf57b53e1edd6a3ff0f94598d87fcf7b66456dcddebf9b16bf

SHA512
f993ccd746e87c0a9794cd53a0649d89e7a42575669ec66efa8c26cd8251e02862ac38e310f8ac5c41f1188034ef4dfd19ca4fdfc54b3f14a2224183fc688a3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe

Filesize
468KB

MD5
b82ef336de20b3f6ddcb9b41057d429e

SHA1
36685987db097950748374f1974018b144ca6ac2

SHA256
69f67b4e33e861bd7c980f4a7ed66b8b0837d645d6633f21d9aa8a7fa4e09dcf

SHA512
b0e39c254f45f49356222d233dc3d99f1e9c97cb78ad3d35c65f30cd22a332ebd85e397391be5a9cace8f52801b92a9e14086aa0aab6918305aed6d7dfb6c921

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe

Filesize
468KB

MD5
a6ca69354e011102cf112f8f8ac53588

SHA1
e13611ae9d531fd1aa6f22864323425bdc461428

SHA256
c4396ac0d15aac00d093048d002059121c189bd5f8e311f61f2877aa0c5ad383

SHA512
c3422465e12418f2ddd3e6177f01845978306f639d97ea6634a9fe57ed8193c04bcd85d8f3e89f039aa1cac18e51f97c2987a76ce346c23d4840f1876878ee99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe

Filesize
468KB

MD5
4dc6643ae138cd86b50fd156be8380f4

SHA1
e98da10c509db2f26d29c86e0ca08dbc46705459

SHA256
1cd10d2b20f777cd667e3a66cffdae2216ca12b1342bcff1dbda2b4e7f18b0cb

SHA512
461be7ff0e29394946d2584c4c16a4972f95c0f7f3115729023cf22e244607fbfd542f3dee8eda40b8cb265b1d83f9c0d92eaf8c8bc463e6a36d2ac898fab48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe

Filesize
468KB

MD5
94a7476b55dcca6205f9f4c7756e3d2c

SHA1
408cc7e0ed933fdbf0ed76f7a4ddca5aaf245e0c

SHA256
905900fb1b7f07032c7be6b63ca93f45db3c6c4f2a00f4098a770b726687f4eb

SHA512
a0067cf98f76113a8e6e85b83df25ad77c9ea1a9ff18928361182d4548f395c3886d3397501c42152f97f308f6a327b540699ba186dd5c2d9a6962a93395bdd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe

Filesize
468KB

MD5
a86d687ae8194e7994193aff89924243

SHA1
66c0017ef4f8d71921fdbda69516595b45da43c9

SHA256
a93f3fca8481169e6a789fa89ba4679ebca7f0b776c6ec7239247cee766746b1

SHA512
0be64562feee1dd14b4586ef70c7864daf088d2c11b61c36183d1ca8a874e36e087362616ac864c524bd7c926a5ce125f49368b4bbaf5dc1809c7161c9b2cca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe

Filesize
468KB

MD5
65fd3f513b0cfeb67e1703132b025e6b

SHA1
af23bbc01ac12e98b8a8e2162628c08e1248ed96

SHA256
f99a6dca13d23d9ef42ba4d5f569770adc14b7da41e7fb03ee6408bb55b17281

SHA512
d9328884223344a634e76769557ae725ae66475d22432e16bb1dcdb0c99eb6ced81faf309676aadec3ec584bc8969c1a70539b8ba85a9c76cb34228cd118161d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe

Filesize
468KB

MD5
9aa9fe04a982495963c5bd0f26f5bd6f

SHA1
9afcf9a2bd93a293f168a7c68eb3c908f0a1538e

SHA256
83068f4c27b6e971a3d840be8489b191a10dfc2772e4659e591fee12afb42d80

SHA512
99016102afcee331ab18035d4c753c2ec5d3f01c7c34b0e7a2163563ace096eab497b79d32b78a8b1db2b73b3743584643ea35b160bf0559054e6699ceb0a842

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe

Filesize
468KB

MD5
822551ecd9f2014cda8a41b59254546e

SHA1
00a0265e9007d6db3f07e36e9ee330e2150fd0e9

SHA256
d4eecbb5b2030e111baac224050d67f32bc596c2753fc9db05fa6f610b87e18b

SHA512
e8634ffad564bbb3eb6f4ff981a2657c52129c8f49b61ee40b8882b4ebbfc5a64b29a7688d0dbccb936f13e297c0c7f5acc18d343c2bb8be1d967667046ecab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe

Filesize
468KB

MD5
43f5bd52dfc5b75401fd0fef6dd5763f

SHA1
d0c4a64771529be60f50f12d79a5c21757a3ff88

SHA256
8412ab893eff8bc322d3d6d5c631d3920a20b487548c81604916d220aa213384

SHA512
83b788bfc8cc4db613dd2994fc8fb056a48e78506967a011eef059eb75e578d3511d8f9953808c66ef0c828c99bf87f8fcece2fecd8e14a013c32bf5ed377c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe

Filesize
468KB

MD5
f4445e8f3d39c93a347a6dcfdb60875d

SHA1
31de8a51a9059e209ae75e5f31a89d02e6460c56

SHA256
22c210602ec8c342c5d1885ec8fbe34b1b658c8f493dfb7575ac5af604010d06

SHA512
3867c56d1badb1d8fd061ee75c50ea3418d8991221354d3584d7028c5fbfcc9eaa1320240cc85cf06013b96527d0c2c13a59d7cab720f2ecdf079b5b3c8d60f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe

Filesize
468KB

MD5
b6c3aa9411da9dbfafca51bf4a219207

SHA1
df72c924d385e69b458e1cb454f6406dd5ec94af

SHA256
f4fb85279612176343ba26bc7049c84be9021af0892bdf4bec0b018541ae8938

SHA512
edca4dab35b8213d022e285f2c7d1f6b64d537fa7794a9f0f630ea1df496a64704ba66d524c4bc7afb3bff04c134234e3d69703c8b63ba3ed4a7850c3a05635f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59749.exe

Filesize
468KB

MD5
203ab68d1a61da8a0d9f8ffdd06efb68

SHA1
e3378c6b36d6119beb361c6f367008e3823d936e

SHA256
c36caab41eb5c96ab593d4ad82c3e6b1fa67003e484df5fc9b08ffc783b917ac

SHA512
a8a1b5ad5b30fc935315968cb72181206f4ae82af4353786dca24df8c197b5f0bb3048c17d0c0bdacf3e631902f577f97ad8fe92b88f2580f9b44f1c04299e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe

Filesize
468KB

MD5
ac90a82d5d32cbe0872edb074e0001bc

SHA1
c8b7ba87089615475b2ea5a4c2773ad69464ad41

SHA256
e2e7081f346ad1aa525992a04c4c6e447cce165c6126c5d0cb9a248e8cf475ed

SHA512
14faa784ed5cd835ece70d88245c4b218ccecc2ce224f364ca23ec98036019f89d3c864a7099b781cf8f37cd301acf691a096a0f7b853d7576e68c0efdf98ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe

Filesize
468KB

MD5
caa9c1b2c96b0e5751a42b6b6700ea7c

SHA1
7b33df6d11e3febefb441fb7a415409751208095

SHA256
062806c961e3538403835dddf5431186468d0c1c158d43c9a30923bc29259798

SHA512
0beadf3f6306782cccc251b19df3af1ace31a7f96d669451edd31b662dcdf1d0dd90257207e1fc72b41cafc3d7b2e8b3e0f2905737334a00c5d1e730ceeb87da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe

Filesize
468KB

MD5
542e5301b75e7f52f0f6c1dfe8a693cb

SHA1
f4667eaa7496bb561fdd019a78961a8904666bb3

SHA256
5478c7313008fc9d2e7ba8fe53504197845ef7306eb8927ef9601b7a3054b491

SHA512
9b23bf4f3ee7479d4f39199dafe1f090817c8bd2a7ffca1c3686aee109217fa119344e598f0adbfc1ec8fddb5ae9d593db2991885c103566f962ae051de2fafe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe

Filesize
468KB

MD5
5b5120e98e47f10e8cb0e96a0497fea4

SHA1
7792ad407ede5cc3d7cfd52a107f555035726e92

SHA256
6fa0a6f561c5bc9b610100909b6b5a33fd6ec62888577c491bcafeb4e9b1d50a

SHA512
d5583742f175ca9f30a3650ea3e5417cff9747f6bb3d09b2b2f14b15cf04fd43d2dd4b980c73459bfca1154736eb5d7d61dc2c3da762eca69bc6df490095cc0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe

Filesize
468KB

MD5
60b6e3ce810ebabd6f231eba9559b760

SHA1
6ff2c493c60885c30a3487054604b6fa02bb7e0d

SHA256
1725fba1a122dd08d39a0c64344d518937a6caa7fb53d19eca393eb3aee29f71

SHA512
b2a4ea65ee3e6ba33a09319ff771736c1e558a4581ac83f29d0e1bb2d2408a8fc46ad625e074bc379acd299af74cdea321c0e5a891195b405f27759f256ce381

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe

Filesize
468KB

MD5
15b61df20383a58ed6570350bc6ad760

SHA1
efd34fd8fb90072dbb8f8cd740f427994266e876

SHA256
1c149b89cd8d3d4cb99d28f76b3c339b42809c8827808085be0e1615245bf5c2

SHA512
9c6f6c44162e9a59ff32d26b682fb573737cab379c8ff4de22c4de92858cde7bd85cbf102a4a8575517365d662f571fc09633f3a62a7ef1e6c0a883b457756e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe

Filesize
468KB

MD5
1113965627ab8a3f113588b2297a5683

SHA1
5a3beabb2394f890714b2c58ccdfaaff427244cc

SHA256
0718f23d8e7e5e79a9c315a2054c9caf7990490ff3933b72f901f64422476997

SHA512
31759b72ac612f06c3a0868a032063a4966d0ee7f3e8c3bc054cae21a54d534739de85ce62dd7704a490f68b00283122830ec490ad56367241f450383b814235

Download Submit
memory/376-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/668-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/668-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/668-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/788-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/948-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-3710-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-3558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-3709-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3420-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3604-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3828-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3860-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-3706-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5740-3563-0x00000000771A0000-0x0000000077215000-memory.dmp

Filesize
468KB

Download
memory/5748-3707-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6356-3575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6692-3439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7060-3297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8084-3708-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8264-3712-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15528-3590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download