7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43

Analysis

max time kernel
119s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe
Size

468KB
MD5

09c474b6de1e70c5d527d93d10d1b030
SHA1

0b0b5f93559310a52e7e4ebdd778003d477c051b
SHA256

7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43
SHA512

9caec18fb3589771daa52ca18846db907c78c9c311afc396dfecc2ab74e72b5326a026bea31783db4ef1369933fdcf3b612cdc4db0f5883e4e4c3662ca02e457
SSDEEP

3072:t3jCogWxoK8aubx8Pz/Cff8/ECGPoIpo/mHBaVrlofO3SHBEDdmF:t3Go2zauGPbCffE0tsofEUBED

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3520	Unicorn-1470.exe
1696	Unicorn-63167.exe
1812	Unicorn-50915.exe
2964	Unicorn-35695.exe
3560	Unicorn-35695.exe
4196	Unicorn-45901.exe
2508	Unicorn-48995.exe
4260	Unicorn-53583.exe
376	Unicorn-49862.exe
2532	Unicorn-55887.exe
2748	Unicorn-55887.exe
940	Unicorn-23407.exe
1736	Unicorn-39478.exe
2276	Unicorn-33612.exe
748	Unicorn-19877.exe
4524	Unicorn-39471.exe
1640	Unicorn-3461.exe
4756	Unicorn-26591.exe
4728	Unicorn-11131.exe
2684	Unicorn-41418.exe
5108	Unicorn-44218.exe
1632	Unicorn-50348.exe
3712	Unicorn-27004.exe
4300	Unicorn-28453.exe
5004	Unicorn-28453.exe
2864	Unicorn-48319.exe
2004	Unicorn-1292.exe
4944	Unicorn-48319.exe
2952	Unicorn-20892.exe
3076	Unicorn-42559.exe
1144	Unicorn-25647.exe
4556	Unicorn-19708.exe
1056	Unicorn-55174.exe
1208	Unicorn-11541.exe
2744	Unicorn-11541.exe
3056	Unicorn-3742.exe
2304	Unicorn-3358.exe
2000	Unicorn-51718.exe
1588	Unicorn-2133.exe
4508	Unicorn-56316.exe
3656	Unicorn-8734.exe
1440	Unicorn-8734.exe
2088	Unicorn-58236.exe
3612	Unicorn-32770.exe
3024	Unicorn-14126.exe
3932	Unicorn-41738.exe
4448	Unicorn-10789.exe
2228	Unicorn-57005.exe
4680	Unicorn-63135.exe
3220	Unicorn-62870.exe
2860	Unicorn-46835.exe
2308	Unicorn-47100.exe
1996	Unicorn-47100.exe
2780	Unicorn-45382.exe
2624	Unicorn-26444.exe
4852	Unicorn-32575.exe
2056	Unicorn-65055.exe
2840	Unicorn-58925.exe
3628	Unicorn-56317.exe
4240	Unicorn-32191.exe
4396	Unicorn-60566.exe
2028	Unicorn-28770.exe
4040	Unicorn-48371.exe
4772	Unicorn-60566.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
7284	5704	WerFault.exe	213
11832	5704	WerFault.exe	213
16292	13096	WerFault.exe	624
16344	4520	WerFault.exe	689
16356	14024	WerFault.exe	697
1060	6392	WerFault.exe	248

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30262.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe
3520	Unicorn-1470.exe
1812	Unicorn-50915.exe
1696	Unicorn-63167.exe
2964	Unicorn-35695.exe
3560	Unicorn-35695.exe
4196	Unicorn-45901.exe
2508	Unicorn-48995.exe
4260	Unicorn-53583.exe
376	Unicorn-49862.exe
748	Unicorn-19877.exe
1736	Unicorn-39478.exe
2276	Unicorn-33612.exe
2748	Unicorn-55887.exe
2532	Unicorn-55887.exe
940	Unicorn-23407.exe
4524	Unicorn-39471.exe
1640	Unicorn-3461.exe
4756	Unicorn-26591.exe
4728	Unicorn-11131.exe
3712	Unicorn-27004.exe
2684	Unicorn-41418.exe
1632	Unicorn-50348.exe
5108	Unicorn-44218.exe
5004	Unicorn-28453.exe
2952	Unicorn-20892.exe
2864	Unicorn-48319.exe
2004	Unicorn-1292.exe
4300	Unicorn-28453.exe
4944	Unicorn-48319.exe
3076	Unicorn-42559.exe
4556	Unicorn-19708.exe
1056	Unicorn-55174.exe
1144	Unicorn-25647.exe
2744	Unicorn-11541.exe
1208	Unicorn-11541.exe
3056	Unicorn-3742.exe
2304	Unicorn-3358.exe
2000	Unicorn-51718.exe
1588	Unicorn-2133.exe
4508	Unicorn-56316.exe
1440	Unicorn-8734.exe
2088	Unicorn-58236.exe
3612	Unicorn-32770.exe
3656	Unicorn-8734.exe
3024	Unicorn-14126.exe
4448	Unicorn-10789.exe
3932	Unicorn-41738.exe
4680	Unicorn-63135.exe
2228	Unicorn-57005.exe
3220	Unicorn-62870.exe
2308	Unicorn-47100.exe
2624	Unicorn-26444.exe
1996	Unicorn-47100.exe
2860	Unicorn-46835.exe
2056	Unicorn-65055.exe
2840	Unicorn-58925.exe
2780	Unicorn-45382.exe
4396	Unicorn-60566.exe
4040	Unicorn-48371.exe
4240	Unicorn-32191.exe
2028	Unicorn-28770.exe
4852	Unicorn-32575.exe
3628	Unicorn-56317.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3520	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	88
PID 1312 wrote to memory of 3520	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	88
PID 1312 wrote to memory of 3520	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	88
PID 3520 wrote to memory of 1696	3520	Unicorn-1470.exe	95
PID 3520 wrote to memory of 1696	3520	Unicorn-1470.exe	95
PID 3520 wrote to memory of 1696	3520	Unicorn-1470.exe	95
PID 1312 wrote to memory of 1812	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	96
PID 1312 wrote to memory of 1812	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	96
PID 1312 wrote to memory of 1812	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	96
PID 1812 wrote to memory of 2964	1812	Unicorn-50915.exe	100
PID 1812 wrote to memory of 2964	1812	Unicorn-50915.exe	100
PID 1812 wrote to memory of 2964	1812	Unicorn-50915.exe	100
PID 1696 wrote to memory of 3560	1696	Unicorn-63167.exe	99
PID 1696 wrote to memory of 3560	1696	Unicorn-63167.exe	99
PID 1696 wrote to memory of 3560	1696	Unicorn-63167.exe	99
PID 1312 wrote to memory of 4196	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	101
PID 1312 wrote to memory of 4196	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	101
PID 1312 wrote to memory of 4196	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	101
PID 3520 wrote to memory of 2508	3520	Unicorn-1470.exe	102
PID 3520 wrote to memory of 2508	3520	Unicorn-1470.exe	102
PID 3520 wrote to memory of 2508	3520	Unicorn-1470.exe	102
PID 2964 wrote to memory of 4260	2964	Unicorn-35695.exe	107
PID 2964 wrote to memory of 4260	2964	Unicorn-35695.exe	107
PID 2964 wrote to memory of 4260	2964	Unicorn-35695.exe	107
PID 1812 wrote to memory of 376	1812	Unicorn-50915.exe	108
PID 1812 wrote to memory of 376	1812	Unicorn-50915.exe	108
PID 1812 wrote to memory of 376	1812	Unicorn-50915.exe	108
PID 3560 wrote to memory of 2748	3560	Unicorn-35695.exe	110
PID 3560 wrote to memory of 2748	3560	Unicorn-35695.exe	110
PID 3560 wrote to memory of 2748	3560	Unicorn-35695.exe	110
PID 4196 wrote to memory of 2532	4196	Unicorn-45901.exe	109
PID 4196 wrote to memory of 2532	4196	Unicorn-45901.exe	109
PID 4196 wrote to memory of 2532	4196	Unicorn-45901.exe	109
PID 2508 wrote to memory of 940	2508	Unicorn-48995.exe	111
PID 2508 wrote to memory of 940	2508	Unicorn-48995.exe	111
PID 2508 wrote to memory of 940	2508	Unicorn-48995.exe	111
PID 1312 wrote to memory of 1736	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	112
PID 1312 wrote to memory of 1736	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	112
PID 1312 wrote to memory of 1736	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	112
PID 3520 wrote to memory of 2276	3520	Unicorn-1470.exe	113
PID 3520 wrote to memory of 2276	3520	Unicorn-1470.exe	113
PID 3520 wrote to memory of 2276	3520	Unicorn-1470.exe	113
PID 1696 wrote to memory of 748	1696	Unicorn-63167.exe	114
PID 1696 wrote to memory of 748	1696	Unicorn-63167.exe	114
PID 1696 wrote to memory of 748	1696	Unicorn-63167.exe	114
PID 4260 wrote to memory of 4524	4260	Unicorn-53583.exe	115
PID 4260 wrote to memory of 4524	4260	Unicorn-53583.exe	115
PID 4260 wrote to memory of 4524	4260	Unicorn-53583.exe	115
PID 2964 wrote to memory of 1640	2964	Unicorn-35695.exe	116
PID 2964 wrote to memory of 1640	2964	Unicorn-35695.exe	116
PID 2964 wrote to memory of 1640	2964	Unicorn-35695.exe	116
PID 1736 wrote to memory of 4756	1736	Unicorn-39478.exe	117
PID 1736 wrote to memory of 4756	1736	Unicorn-39478.exe	117
PID 1736 wrote to memory of 4756	1736	Unicorn-39478.exe	117
PID 376 wrote to memory of 4728	376	Unicorn-49862.exe	118
PID 376 wrote to memory of 4728	376	Unicorn-49862.exe	118
PID 376 wrote to memory of 4728	376	Unicorn-49862.exe	118
PID 1312 wrote to memory of 2684	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	119
PID 1312 wrote to memory of 2684	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	119
PID 1312 wrote to memory of 2684	1312	7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe	119
PID 1812 wrote to memory of 5108	1812	Unicorn-50915.exe	120
PID 1812 wrote to memory of 5108	1812	Unicorn-50915.exe	120
PID 1812 wrote to memory of 5108	1812	Unicorn-50915.exe	120
PID 748 wrote to memory of 1632	748	Unicorn-19877.exe	121

C:\Users\Admin\AppData\Local\Temp\7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe
"C:\Users\Admin\AppData\Local\Temp\7e7466822f8260a475c66e557a09ecb85320508cba0efe001994b7717eb4ec43N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        9⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        9⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        9⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        9⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
        8⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50419.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        7⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        6⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
        9⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        8⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 464
        9⤵
        Program crash
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49613.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        7⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59651.exe
        6⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        7⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20524.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        6⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        9⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        8⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        7⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        7⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        6⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        7⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        7⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
        7⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        6⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        5⤵
        
        PID:5704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 628
        6⤵
        Program crash
        
        PID:7284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 676
        6⤵
        Program crash
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
        5⤵
        
        PID:15016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        10⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        9⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        9⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        8⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        9⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        9⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exe
        7⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        8⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        7⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        7⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        6⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10789.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        7⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        6⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        7⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        6⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        6⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        5⤵
        
        PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        6⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5075.exe
        8⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        7⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        7⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 744
        7⤵
        Program crash
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        5⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        7⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        6⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15375.exe
        5⤵
        
        PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60015.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15846.exe
        7⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        6⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        5⤵
        
        PID:13692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
      4⤵
      PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        5⤵
        
        PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        9⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
        7⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        6⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        7⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22287.exe
        6⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45382.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        7⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        6⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        6⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
        7⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        6⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        5⤵
        
        PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11934.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        7⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        6⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
        7⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        6⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        6⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        5⤵
        
        PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        7⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        6⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62246.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        5⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        6⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19100.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        5⤵
        
        PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
      4⤵
      PID:11152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-670.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        7⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        6⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
        5⤵
        
        PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
      4⤵
      PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
      4⤵
      PID:15224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        6⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        5⤵
        
        PID:10804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        5⤵
        
        PID:14880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
      4⤵
      PID:12620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        6⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        5⤵
        
        PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
      4⤵
      PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        5⤵
        
        PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
    3⤵
    PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
      4⤵
      PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        5⤵
        
        PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
      4⤵
      PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
    3⤵
    PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
      4⤵
      PID:15372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
    3⤵
    PID:7876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
    3⤵
    PID:3036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53583.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32575.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
        9⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7445.exe
        10⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        10⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exe
        9⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        9⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        8⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
        8⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        8⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        7⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        7⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64500.exe
        7⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        6⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        9⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        9⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        8⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24678.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        7⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46947.exe
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17778.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        8⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        7⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exe
        6⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        6⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        7⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        6⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        6⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
        5⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        5⤵
        
        PID:14500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        9⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        7⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        6⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        8⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
        7⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        6⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exe
        5⤵
        Executes dropped EXE
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40457.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28.exe
        6⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        7⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        6⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        6⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10307.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34710.exe
        6⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
        5⤵
        
        PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        7⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        7⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        6⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        5⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        5⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        5⤵
        
        PID:15064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        7⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27548.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        6⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        5⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        6⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        5⤵
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        6⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        5⤵
        
        PID:9280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        5⤵
        
        PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
      4⤵
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
      4⤵
      PID:14324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        6⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
        7⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62231.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        7⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        7⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        7⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        6⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        6⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        5⤵
        
        PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7445.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        7⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14024 -s 436
        8⤵
        Program crash
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        6⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23094.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        5⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32684.exe
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        6⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        5⤵
        
        PID:12636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
      4⤵
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        7⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        6⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        6⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35613.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        5⤵
        
        PID:12860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
      4⤵
      PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
      4⤵
      PID:12864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23174.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        5⤵
        
        PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
      4⤵
      PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        5⤵
        
        PID:12996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
      4⤵
      PID:12088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
    3⤵
    PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
      4⤵
      PID:12676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
    3⤵
    PID:8448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
    3⤵
    PID:10324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
    3⤵
    PID:15156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45901.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45901.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
        7⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        6⤵
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
        5⤵
        
        PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
        7⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53693.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
        6⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe
        5⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        6⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        5⤵
        
        PID:12824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
      4⤵
      PID:14656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        7⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        6⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
        6⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        5⤵
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
        6⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        5⤵
        
        PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe
        5⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        5⤵
        
        PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
      4⤵
      PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      4⤵
      PID:14132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
      4⤵
      PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        5⤵
        
        PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
      4⤵
      PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
      4⤵
      PID:14836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      4⤵
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17836.exe
    3⤵
    PID:12012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        6⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6693.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15894.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
        5⤵
        
        PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
      4⤵
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51919.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        6⤵
        
        PID:13200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21372.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        5⤵
        
        PID:14960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        5⤵
        
        PID:12536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39152.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
      4⤵
      PID:13084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
      4⤵
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        6⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13096 -s 464
        7⤵
        Program crash
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        5⤵
        
        PID:15732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        5⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
      4⤵
      PID:15100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
    3⤵
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
      4⤵
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
      4⤵
      PID:14812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
      4⤵
      PID:15036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
    3⤵
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26943.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46509.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50327.exe
      4⤵
      PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
      4⤵
      PID:15992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
    3⤵
    PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
      4⤵
      PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicor÷-13861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicor÷-13861.exe
        5⤵
        
        PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
      4⤵
      PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
    3⤵
    PID:12916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32770.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32770.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        5⤵
        
        PID:12944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
      4⤵
      PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50803.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
      4⤵
      PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        5⤵
        
        PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      4⤵
      PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
      4⤵
      PID:15348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
    3⤵
    PID:8288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
    3⤵
    PID:8224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
  2⤵
  PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
    3⤵
    PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
      4⤵
      PID:15656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
    3⤵
    PID:7872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
    3⤵
    PID:12980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
    3⤵
    PID:12224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
    3⤵
    PID:12644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
  2⤵
  PID:9296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20390.exe
    3⤵
    PID:16172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
  2⤵
  PID:12832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5704 -ip 5704
1⤵
PID:7540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5704 -ip 5704
1⤵
PID:10480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 14024 -ip 14024
1⤵
PID:16088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 14208 -ip 14208
1⤵
PID:16196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1352 -ip 1352
1⤵
PID:16252

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe

Filesize
468KB

MD5
ee78ed9556d85cfb512bdead35c72488

SHA1
7d4dfd55113ffa01b1b887e6ad38f55dd7df6ea8

SHA256
28284bae123448949a374de9106766e602528eb6d445f92c701baa07d114e8ce

SHA512
ff05e6b22dd3076775001c920cc456aef3c21b89880dfc516158b573c4f37c5567ebc69d52269d6c52f40a3ecaf6d59ad694b86aa7249e12983bb2d612ec6330

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1292.exe

Filesize
468KB

MD5
f3c158c431b95aa18020abc6d947d62e

SHA1
093e36e2e6a740ca344fbffe6098b0e6e5ecbf1c

SHA256
0d3b1f05094c961b10dcc98245291a74c604079290439f1524ee95201cda9fe2

SHA512
b64fea33c5f7a627abb2de49e3855730eb1eadc537df5bc8c5486c3ba4e7d61abde5100cd2a355b002a31fd04facfa339465d6339b3ad7e87f2edefa323e3108

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe

Filesize
468KB

MD5
ebd7dc848b49885d5b623e5a4cb09bbb

SHA1
20beea376cab63c4f2fb1f2f59c0216838aa5d7b

SHA256
528e3c0131a3d2693ca70e7baace7de44716a2f807708c591f8fce5f97edc15f

SHA512
bbece9f7e0b680b46cc88be0af2b08a53ef0a2ca1881c832d350a16855c23c60da0025e6b1f97f63867143e9c1dd5b632f5150fee50380c6150a16cb365bfedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe

Filesize
468KB

MD5
5e38c1c08fa1d51d72cec89fe3b4248e

SHA1
114a1da442232719e8ed1e4bd422a447b2972cd0

SHA256
4a86a5048bd30a63dc7af19ea9c591e7524eef949b6f690472a292106a201c69

SHA512
126df5b64752bbf7f7ba9976431df912871aa657459e884c37f49cfd6f9257a7a5cbef1dda88edf9efa67dab412efa4548bc1fdb13619e63ade8f9b9584dd9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe

Filesize
468KB

MD5
fd152551ee2971e792ca01ae705208a3

SHA1
67a4a9d977ca5a7b6436ae1982dae0ebf9914121

SHA256
4a2654f6908ae069330fd8828414a3cf55377bc831e35c2b48ea1ec9b05ec541

SHA512
2a7dc2c54cd87ca01816ae5ed31e9bbdeb82d2dacbd28d73563468aa5e82551e0e8d63ede3456ecea2fc643ea81ac9d8f8b50ec2525bf8aa286b60a05309cff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe

Filesize
468KB

MD5
d169b3e5ebe0403616eb5af10630fdf4

SHA1
6784f91183e0f7155be5e8f397f1de216bcbcd3e

SHA256
4d56fb6d70dabeaa389599f07ddb3671954d8af1af9d86adb65d2ff5c605ce19

SHA512
57d7deb73e5d3f144cca35f81ea6f4d4702882ba73117f98fb7e3fd48ca8acbac7a825471a55e2c24650a8e62f78b3c088462f318b0df831e65121ff90f72788

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe

Filesize
468KB

MD5
12ceb98f56cfb20421e4b6a58995cd68

SHA1
07abda50b5fdfa10f4e8dceb43c6693230c923e4

SHA256
7f2baf7ac3735c29f5c9cbf6b1cb4bbcbab5ce854b7f67dbdcd49e9729bd7f13

SHA512
e5778534aaeb0b56b0c4813b97fff266620a3592adbc97eac7cda01817e255e5c1e95e4d1a4ba2dce6e1aa47ee579874aa20a8ad5c6a5a6260d7261e1d9b3395

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe

Filesize
468KB

MD5
587a077673b67016b0fdf3e083fb3c7d

SHA1
c86fe1bb21a23952c6ccb4c66749eaf304d34cac

SHA256
c130543b0f68cc8452fe0c541f01866d8c4c82e668a0d594752e586049752c77

SHA512
6edbd35e55d71175cce48a5d7bce68d636487a48bcca7148c79060e925b4f3367ee7a98d1d61bb6d292b547c9b79eef37ef50e20cfe527906908b1b363b715c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe

Filesize
468KB

MD5
91e96464a83bc4cc85b7dc8cfabbb77c

SHA1
20638b432673dec49cfd3979aeb1943793730d1c

SHA256
bc7795895b81ffa9f15ee674817968fb0c6997addb90bba948fe39f899699864

SHA512
e85e5feb465b3379cdf3a692d97abcd1be50d6b2f8f642fa4eb4a57232360220df313a78f1cea9e9bbe84b419d5627c693a36a0c6b4ffd1aab74927423f9641e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe

Filesize
468KB

MD5
87b531951bcf8f7d9375ebdc7f4db782

SHA1
c443c8098d676a323cffb326e46b9b1420d6498c

SHA256
0688379b90bf841ec83ad168f83d3ece64ecb9d6d9f322f035d0393201b5450c

SHA512
345d8796ff7655b5c39fc448178fa006d593d8e82f6c43ca15ec47a2e485505e9e0e5dff6996e487ab462c64f90befe38976d2fa6672bb5a97be70a96b849661

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe

Filesize
468KB

MD5
be5710879db391c44b3b0dabe90744b2

SHA1
6f13458372c19ce670713e3ad6afe1e98673ef93

SHA256
21bff884249fb0fdaa8eb3031656e9eedcd31d15ab02d9d1f447c1ebb9957e10

SHA512
dd83596b97ba47721b3a31b99ad2bf25db134d03879250707a33073101718cdff306096a90c390852f5cfe49ad1eb4fbced6f569700f1f5b0deb562117af15d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe

Filesize
468KB

MD5
a6c9e0ced0fb6f3de8a709db17fa52d1

SHA1
83749762caa70bd59f7fb60f556507c05c321f42

SHA256
572f753ca9c3fc4ad9689f1399f7da57064b516bb2b968ce5cb5389258870915

SHA512
9cc305499901e0418ff9ed37657bf8ed43394ff050269745d60cae83361f274b1c297f6b802d4ed8902fb1754e33bd1d63a6bdeedf4c338908e47b987b42830e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe

Filesize
468KB

MD5
3fbde4fb78b44fca3dc0b145afb8c3b5

SHA1
7864ebd5abf2630003b3d4f9cc8cc3fd235004ab

SHA256
911d1f8cf5e46036ba1cb2111e1f06f81aa27a6388c0617f01da55cd016bd962

SHA512
0a761a28e84954d3f788cc3e42004fe64827c43b750c17c5d7fef3f147db709056c845f5a04f215976a183617f464996a40ef364ecc80b550fa34fa98eb00201

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe

Filesize
468KB

MD5
e6f901a81c029908959c6c353c9bfe8e

SHA1
917b6b115f0365ea80b9cfb43c765a9a793aa266

SHA256
6d0041726514d51184de7086b15b0f4266447feeb239624d41b94bca33984276

SHA512
b3a31e245644f12b9b60110fa101cb6111264e7f56215dfc3fb41792a207bf67358934f1fe6f4f4e9fcd899be3a1cce09be414d19d3272b7d2e635a643abf681

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe

Filesize
468KB

MD5
3c8bd37aadbe47e9897460810b1b8a17

SHA1
5bd9fe7a8fa6b2bbb56ca1ae0cab93961007714d

SHA256
1c1dc490b221edfe09ee5f39773180ccfe3247676c6f25b06cd0073a447e9760

SHA512
04b1b61266866a4fedef32aae026940d9a455532cd6146328e2e044fac489a86c41290c2881e47e24544ad53309291f4536d965f989d482c81944fd689e4b89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe

Filesize
468KB

MD5
63cf0616d29bf087c148ce25dc5637d9

SHA1
b83b8d38f158850241881ba253a8a4a834bba400

SHA256
52b7b8d8bfdde2fada6bbc66507c94874062d10bd4bee072d93895d1e2ff9902

SHA512
e048253da7b76293d0a2809f377bfaf8f2edd09e5b4d4c436348341fd78719b543c4e5e7e3cf1e7a2e179e68e3ad40a396780d42ccf246c3ab448aff0c3c127c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe

Filesize
468KB

MD5
04cd10f8f7cdb2bfd8ae590a349dc443

SHA1
4f8c6c29dca54870b4a30606b7326280d598c9da

SHA256
a7dce6126ec13c5a7f07dbe82a03299678f8c54a85b109aa9795c08dba59dee8

SHA512
7caef4b81af0fb47b8ff4de8d91149bb58828682fc4456af0fae33d38538c2470767eaf2b6ab3a96304e70d20f02ac9f45d8664cfcf666f1dc61e8b2e4f0661a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe

Filesize
468KB

MD5
550821b5bd4f187d6b99cf47fa522ea1

SHA1
4f4183d20db4f9db3062eeb65d8de7e8dbb54dc9

SHA256
4f47645eff066983e11f3ac408c629f42ccf8f80aec177d225a34f4d2d5d1fe9

SHA512
9495fd43162d2489a9f137c98105d00fe377b45223686ed56d1b733bbbfd3924f67a4bb0ff69fd26efd38c359dc5cb54e0d3841b23af6d7d0d8137048db04cea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe

Filesize
468KB

MD5
4c3072452b6b282a53521275b9275103

SHA1
50a2fbf5d465b4063c1b8aee2a9e45fec6ce69df

SHA256
dbf7bc6c2ad713eac956fc5bce03b29f8a7c84b3003aa7063b12336e495c5d73

SHA512
2f49413901b0da9f1863350d9550f6bc840e8f169726eda515df33bb90472f643dea86748872cf5c29f220635540ffdeb55efd2778ae10c01d7c5c9b03fc8a46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45901.exe

Filesize
468KB

MD5
304892cf2711dfde85ca20f9b9288b66

SHA1
23322fd3256ac58d8c79d6432b80446c0ffe8ee7

SHA256
d647d282eaf875401a68e08d69a740641055d70259d4a61e4616c5962e43969c

SHA512
5974b5843d1eeff091f1b2d313432a08d2243ac57f94b16bc8fecbfba1ef23cb0e2d79c4ecbdf09842be3908fa8b402433aa4ae4f7a89540fe77f54f4b6e69f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe

Filesize
468KB

MD5
d8729af69285c9c607b3eadd520c232c

SHA1
6af50068c633858124631cde8b47149446abe303

SHA256
af3cdf869e331a7df0b5b727b68a76ba45a9204ee1c01dc990b8150d64d5b855

SHA512
b027c4b060498fbc2ffef8c3c5aaea2a0ce32942e70bf94d8b27521921376ec555087a4aa689150479227f10c681fcee3be3c05bbecf24e5112947f6e3654404

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe

Filesize
468KB

MD5
090f1ab7d9b2e29013110e32cbda7685

SHA1
14037047e8d0de15f8cd94c8b2f987a9f682b83b

SHA256
27ddd03200ff31f0e0617ec18e0c14137d9ae2b469f993549de16e84a1bf6a36

SHA512
f3f8361e2f01392a42b1ba31ae23bc8b373a05d544db07fa8713d8bf4ce83ad72bd95c00b63f50b6148bba025a54750262fa5a8a851379596fa4fcecdc82567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe

Filesize
468KB

MD5
7402c79da0597a69fb3665036aa19100

SHA1
91e9bfa6ebb14ad67bdaeea03e93cea96f4a3507

SHA256
5159c574f375b793d35586dff122b2349a08b9d4ece076326c4cdedb1442d97b

SHA512
8063ad226b666e15d01d9ecafe02dc727ab68c4d9e9f742082fff42e5b7e7b194baecc78902dd871ef48bbf5076dcef8ea54ea50b9a4634274094e9f3e9f0c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe

Filesize
468KB

MD5
bd0c8165cfcae8151553828b7dc7ace6

SHA1
fdf47f3bc12191464e2b747a9ee4fe704921fab2

SHA256
83702b89f2c0e2b5fab2b44e665e65f6d42cc4bf7864f0e25d40afe1add76f25

SHA512
aafd88e3e93b165f7c31395a4bfd3db98833b64f02e7a229b7675c9db64e056d70636af8e471bcdb676cc0c29b9bf6cd0a7f8320d0c009b4a4935c9c285c3114

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe

Filesize
468KB

MD5
19ac6446f55159e8512757f8d03bf6a5

SHA1
26554e25aba2f8da3d5d916bb5508da73b5084a5

SHA256
391060d59940623bbcf9616125d9efe9ec6055bc5662b26de9eae9702199f691

SHA512
dfc24800229935cd0cbe233d4256a2694811f61d19c712754faa3c1192c9525a8cffd865e3b01ef72f55d7bcdea3fe1de8208fe03c5969d966af3e47bb98b90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53583.exe

Filesize
468KB

MD5
7d7f35b93052d1de5c682cd8ad68aaa4

SHA1
0f962d4dc422d2e135f7ca9bdeb39d67855e74e3

SHA256
b3cf4bf62f818e8e2be86c1935c1fe16788db70719d38d1152b982db5712b4ff

SHA512
a8d8ba0d6ac8a9e502609a85e178291c1851f6ec04da55afe0551096fa3a3e2965c1478eec7c240b883945796156d6f90634d5b88c72ce9a53ea110f0d5f7e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe

Filesize
468KB

MD5
30761130fbff511d1acf37e0f0724fe0

SHA1
228c936e09a2cb666fdafd7ebd9ce4f3835193b3

SHA256
94a1d1f1acb0058737d26bcbdd45f17353eea6adb04783d298bfe8923a61b810

SHA512
cb47678227b452d14671500050fa32ef2d153f6c42b4f1416426b08e813932726162bca661a2e2ee6268fc72a4fc27b74ba740f371eac1090b044a881c325980

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe

Filesize
468KB

MD5
af7341a241d9bffac55fb3ad7523289c

SHA1
cf418f83c8c5a3077d067b0ea57c2f67ad663356

SHA256
ca44be88ef17f80c493737c2add0fffcc9bf257bb7526c235cc299db6b42c015

SHA512
048c13a8af86aa613fd158242579ab545ace4a0b304911987dfdf4c575b4a8617db83ddbe0b7c38bac0c4e9860b08fa9109e69157d2f2c920abf07d4da757e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe

Filesize
468KB

MD5
d3946a204af2a252567173275c29f127

SHA1
b5374d17c7f531602193d327a71c40e420cb3da1

SHA256
09edd6f453050927bbde7e98d6f6f180053686a7b9e5d1a4bb8f41ae9bb97473

SHA512
597aa026c44c0ac2ac1a037d31d7a28e4329ac4b9ceb53d0b0519b9dc385b4b46cd87f557df157bda88a19b7d01fcecd5f5b5e16cb5acf18460136649e77487b

Download Submit
memory/376-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1056-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-2604-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-2687-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4040-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4240-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4292-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4412-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4680-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5552-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5692-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5740-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5796-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5880-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5936-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5960-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5984-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6032-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6044-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6140-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14812-2611-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download