d81605435e8649289f0522f46cd808b5e726e5bfe7986d020d4573a750e4befd

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48051e0533022a3e68f828bb7d705340N.exe
Size

468KB
MD5

48051e0533022a3e68f828bb7d705340
SHA1

0806cc4a9e7a5ca2cf7a6462359b0177873c55aa
SHA256

d81605435e8649289f0522f46cd808b5e726e5bfe7986d020d4573a750e4befd
SHA512

b2445bfae51959ffdb04f5713128d80d47af09048ef5d9bb9aec2ff035140f640cb86c4639aca0ad9a2da4cbf3838464804e985b1e1d81efc6ca8e9c229ae724
SSDEEP

3072:SO0eogKEIV5jtbY94AcT4f8w4ChCSppLJEHXxVWHJ+8LSKvuWulf:SOBoLjjtS4dT4fhfQwJ+2BvuW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5064	Unicorn-35635.exe
3084	Unicorn-3040.exe
3260	Unicorn-22906.exe
1532	Unicorn-65443.exe
4004	Unicorn-45800.exe
3420	Unicorn-65059.exe
4312	Unicorn-12329.exe
4396	Unicorn-20304.exe
3336	Unicorn-17651.exe
2852	Unicorn-20605.exe
2256	Unicorn-35872.exe
3096	Unicorn-36291.exe
1724	Unicorn-56157.exe
864	Unicorn-50027.exe
2896	Unicorn-55892.exe
5104	Unicorn-37040.exe
4516	Unicorn-50916.exe
376	Unicorn-55872.exe
4280	Unicorn-22816.exe
5072	Unicorn-33898.exe
1984	Unicorn-3443.exe
4076	Unicorn-8700.exe
3268	Unicorn-23968.exe
1392	Unicorn-4102.exe
4044	Unicorn-4979.exe
3308	Unicorn-8316.exe
1664	Unicorn-10739.exe
3460	Unicorn-11004.exe
4960	Unicorn-2074.exe
1284	Unicorn-4874.exe
4548	Unicorn-11004.exe
4672	Unicorn-51648.exe
1276	Unicorn-6038.exe
2352	Unicorn-59645.exe
2028	Unicorn-4122.exe
1596	Unicorn-58877.exe
2928	Unicorn-42349.exe
4648	Unicorn-41280.exe
2516	Unicorn-41280.exe
2768	Unicorn-37558.exe
3112	Unicorn-55051.exe
2952	Unicorn-40246.exe
2376	Unicorn-27476.exe
4948	Unicorn-43968.exe
1484	Unicorn-30512.exe
4360	Unicorn-14860.exe
4324	Unicorn-26790.exe
3924	Unicorn-42934.exe
4844	Unicorn-56670.exe
2112	Unicorn-13599.exe
2248	Unicorn-4278.exe
4588	Unicorn-12831.exe
2848	Unicorn-46573.exe
1592	Unicorn-65431.exe
936	Unicorn-53501.exe
1932	Unicorn-65431.exe
2832	Unicorn-3231.exe
5032	Unicorn-35904.exe
3216	Unicorn-60715.exe
3872	Unicorn-46987.exe
3852	Unicorn-35904.exe
2460	Unicorn-33251.exe
1176	Unicorn-52852.exe
640	Unicorn-22064.exe

Program crash 41 IoCs

pid	pid_target	Process	procid_target
5764	1664	WerFault.exe	120
5336	1664	WerFault.exe	120
4140	936	WerFault.exe	149
7460	936	WerFault.exe	149
9580	6036	WerFault.exe	200
9336	6036	WerFault.exe	200
17956	15740	WerFault.exe	783
17896	14856	WerFault.exe	784
18044	15624	WerFault.exe	788
16740	15372	WerFault.exe	785
5732	15728	WerFault.exe	793
18412	3860	WerFault.exe	818
17904	2540	WerFault.exe	824
17976	5184	WerFault.exe	1004
5504	16780	WerFault.exe	849
17972	15412	WerFault.exe	816
5560	16164	WerFault.exe	801
16740	16332	WerFault.exe	807
5764	16448	WerFault.exe	833
5688	15660	WerFault.exe	827
6192	16836	WerFault.exe	853
18292	16312	WerFault.exe	806
6440	16952	WerFault.exe	857
6632	16152	WerFault.exe	820
5736	16512	WerFault.exe	835
3580	16760	WerFault.exe	847
17900	16644	WerFault.exe	869
7116	16852	WerFault.exe	874
5508	1192	WerFault.exe	896
18356	408	WerFault.exe	877
16436	17844	WerFault.exe	909
17180	17624	WerFault.exe	902
17156	17980	WerFault.exe	915
5304	18240	Process not Found	931
18276	17504	Process not Found	956
17688	17592	Process not Found	1103
3412	6652	Process not Found	1117
5720	5776	Process not Found	1164
16772	5828	Process not Found	1152
16552	6192	Process not Found	1102
5908	17636	Process not Found	1166

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59092.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4920	Process not Found
Token: SeChangeNotifyPrivilege	4920	Process not Found
Token: 33	4920	Process not Found
Token: SeIncBasePriorityPrivilege	4920	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4420	48051e0533022a3e68f828bb7d705340N.exe
5064	Unicorn-35635.exe
3084	Unicorn-3040.exe
3260	Unicorn-22906.exe
1532	Unicorn-65443.exe
4004	Unicorn-45800.exe
3420	Unicorn-65059.exe
4312	Unicorn-12329.exe
4396	Unicorn-20304.exe
3336	Unicorn-17651.exe
2852	Unicorn-20605.exe
864	Unicorn-50027.exe
1724	Unicorn-56157.exe
2256	Unicorn-35872.exe
3096	Unicorn-36291.exe
2896	Unicorn-55892.exe
5104	Unicorn-37040.exe
4516	Unicorn-50916.exe
376	Unicorn-55872.exe
4280	Unicorn-22816.exe
5072	Unicorn-33898.exe
1984	Unicorn-3443.exe
4076	Unicorn-8700.exe
1392	Unicorn-4102.exe
3268	Unicorn-23968.exe
3308	Unicorn-8316.exe
4044	Unicorn-4979.exe
1664	Unicorn-10739.exe
4960	Unicorn-2074.exe
3460	Unicorn-11004.exe
1284	Unicorn-4874.exe
4548	Unicorn-11004.exe
4672	Unicorn-51648.exe
1276	Unicorn-6038.exe
2352	Unicorn-59645.exe
2028	Unicorn-4122.exe
1596	Unicorn-58877.exe
2928	Unicorn-42349.exe
2516	Unicorn-41280.exe
2768	Unicorn-37558.exe
4648	Unicorn-41280.exe
3112	Unicorn-55051.exe
2952	Unicorn-40246.exe
2376	Unicorn-27476.exe
4948	Unicorn-43968.exe
1484	Unicorn-30512.exe
4360	Unicorn-14860.exe
4324	Unicorn-26790.exe
3924	Unicorn-42934.exe
4844	Unicorn-56670.exe
2112	Unicorn-13599.exe
2248	Unicorn-4278.exe
4588	Unicorn-12831.exe
2848	Unicorn-46573.exe
936	Unicorn-53501.exe
1932	Unicorn-65431.exe
1592	Unicorn-65431.exe
2832	Unicorn-3231.exe
5032	Unicorn-35904.exe
3872	Unicorn-46987.exe
1176	Unicorn-52852.exe
2460	Unicorn-33251.exe
3216	Unicorn-60715.exe
3852	Unicorn-35904.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 5064	4420	48051e0533022a3e68f828bb7d705340N.exe	91
PID 4420 wrote to memory of 5064	4420	48051e0533022a3e68f828bb7d705340N.exe	91
PID 4420 wrote to memory of 5064	4420	48051e0533022a3e68f828bb7d705340N.exe	91
PID 4420 wrote to memory of 3084	4420	48051e0533022a3e68f828bb7d705340N.exe	93
PID 4420 wrote to memory of 3084	4420	48051e0533022a3e68f828bb7d705340N.exe	93
PID 4420 wrote to memory of 3084	4420	48051e0533022a3e68f828bb7d705340N.exe	93
PID 5064 wrote to memory of 3260	5064	Unicorn-35635.exe	94
PID 5064 wrote to memory of 3260	5064	Unicorn-35635.exe	94
PID 5064 wrote to memory of 3260	5064	Unicorn-35635.exe	94
PID 3084 wrote to memory of 1532	3084	Unicorn-3040.exe	97
PID 3084 wrote to memory of 1532	3084	Unicorn-3040.exe	97
PID 3084 wrote to memory of 1532	3084	Unicorn-3040.exe	97
PID 4420 wrote to memory of 4004	4420	48051e0533022a3e68f828bb7d705340N.exe	98
PID 4420 wrote to memory of 4004	4420	48051e0533022a3e68f828bb7d705340N.exe	98
PID 4420 wrote to memory of 4004	4420	48051e0533022a3e68f828bb7d705340N.exe	98
PID 3260 wrote to memory of 3420	3260	Unicorn-22906.exe	99
PID 3260 wrote to memory of 3420	3260	Unicorn-22906.exe	99
PID 3260 wrote to memory of 3420	3260	Unicorn-22906.exe	99
PID 5064 wrote to memory of 4312	5064	Unicorn-35635.exe	100
PID 5064 wrote to memory of 4312	5064	Unicorn-35635.exe	100
PID 5064 wrote to memory of 4312	5064	Unicorn-35635.exe	100
PID 1532 wrote to memory of 4396	1532	Unicorn-65443.exe	101
PID 1532 wrote to memory of 4396	1532	Unicorn-65443.exe	101
PID 1532 wrote to memory of 4396	1532	Unicorn-65443.exe	101
PID 3084 wrote to memory of 3336	3084	Unicorn-3040.exe	102
PID 3084 wrote to memory of 3336	3084	Unicorn-3040.exe	102
PID 3084 wrote to memory of 3336	3084	Unicorn-3040.exe	102
PID 3420 wrote to memory of 2852	3420	Unicorn-65059.exe	103
PID 3420 wrote to memory of 2852	3420	Unicorn-65059.exe	103
PID 3420 wrote to memory of 2852	3420	Unicorn-65059.exe	103
PID 4004 wrote to memory of 2256	4004	Unicorn-45800.exe	104
PID 4004 wrote to memory of 2256	4004	Unicorn-45800.exe	104
PID 4004 wrote to memory of 2256	4004	Unicorn-45800.exe	104
PID 3260 wrote to memory of 3096	3260	Unicorn-22906.exe	105
PID 3260 wrote to memory of 3096	3260	Unicorn-22906.exe	105
PID 3260 wrote to memory of 3096	3260	Unicorn-22906.exe	105
PID 4312 wrote to memory of 1724	4312	Unicorn-12329.exe	108
PID 4312 wrote to memory of 1724	4312	Unicorn-12329.exe	108
PID 4312 wrote to memory of 1724	4312	Unicorn-12329.exe	108
PID 5064 wrote to memory of 864	5064	Unicorn-35635.exe	106
PID 5064 wrote to memory of 864	5064	Unicorn-35635.exe	106
PID 5064 wrote to memory of 864	5064	Unicorn-35635.exe	106
PID 4420 wrote to memory of 2896	4420	48051e0533022a3e68f828bb7d705340N.exe	107
PID 4420 wrote to memory of 2896	4420	48051e0533022a3e68f828bb7d705340N.exe	107
PID 4420 wrote to memory of 2896	4420	48051e0533022a3e68f828bb7d705340N.exe	107
PID 4396 wrote to memory of 5104	4396	Unicorn-20304.exe	109
PID 4396 wrote to memory of 5104	4396	Unicorn-20304.exe	109
PID 4396 wrote to memory of 5104	4396	Unicorn-20304.exe	109
PID 1532 wrote to memory of 4516	1532	Unicorn-65443.exe	110
PID 1532 wrote to memory of 4516	1532	Unicorn-65443.exe	110
PID 1532 wrote to memory of 4516	1532	Unicorn-65443.exe	110
PID 3336 wrote to memory of 376	3336	Unicorn-17651.exe	111
PID 3336 wrote to memory of 376	3336	Unicorn-17651.exe	111
PID 3336 wrote to memory of 376	3336	Unicorn-17651.exe	111
PID 2852 wrote to memory of 4280	2852	Unicorn-20605.exe	112
PID 2852 wrote to memory of 4280	2852	Unicorn-20605.exe	112
PID 2852 wrote to memory of 4280	2852	Unicorn-20605.exe	112
PID 3084 wrote to memory of 5072	3084	Unicorn-3040.exe	113
PID 3084 wrote to memory of 5072	3084	Unicorn-3040.exe	113
PID 3084 wrote to memory of 5072	3084	Unicorn-3040.exe	113
PID 3420 wrote to memory of 1984	3420	Unicorn-65059.exe	114
PID 3420 wrote to memory of 1984	3420	Unicorn-65059.exe	114
PID 3420 wrote to memory of 1984	3420	Unicorn-65059.exe	114
PID 1724 wrote to memory of 4076	1724	Unicorn-56157.exe	115

C:\Users\Admin\AppData\Local\Temp\48051e0533022a3e68f828bb7d705340N.exe
"C:\Users\Admin\AppData\Local\Temp\48051e0533022a3e68f828bb7d705340N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20605.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42349.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        8⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        9⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        10⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        10⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-989.exe
        10⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        10⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        9⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56782.exe
        9⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        9⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        9⤵
        
        PID:18252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20717.exe
        9⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        9⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        9⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        8⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        9⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1718.exe
        9⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        9⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        9⤵
        
        PID:18176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        9⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        8⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        8⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10758.exe
        8⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        8⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        8⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50119.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        7⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
        9⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        9⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        9⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        9⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        9⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53671.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        8⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        8⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        8⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        8⤵
        
        PID:15728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15728 -s 464
        9⤵
        Program crash
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        7⤵
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11532.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        8⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        8⤵
        
        PID:16760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16760 -s 476
        9⤵
        Program crash
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        7⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        6⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        9⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        9⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33575.exe
        9⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        8⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
        8⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        8⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        8⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        8⤵
        
        PID:17736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        8⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16152 -s 464
        9⤵
        Program crash
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47115.exe
        7⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        7⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
        7⤵
        
        PID:17836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        7⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26235.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
        7⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exe
        7⤵
        
        PID:18268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        6⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        6⤵
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        8⤵
        
        PID:18168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        8⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        7⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30685.exe
        7⤵
        
        PID:15372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15372 -s 464
        8⤵
        Program crash
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        7⤵
        
        PID:18224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
        6⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 452
        7⤵
        Program crash
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
        5⤵
        
        PID:16332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16332 -s 472
        6⤵
        Program crash
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        5⤵
        
        PID:11536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        8⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        8⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        8⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        7⤵
        
        PID:18336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        7⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47115.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        5⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54788.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        5⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23344.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        8⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        8⤵
        
        PID:18084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        6⤵
        
        PID:16780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16780 -s 436
        7⤵
        Program crash
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        5⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        5⤵
        
        PID:16800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        6⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        6⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64340.exe
        5⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        6⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26628.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
        5⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41611.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
        5⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        5⤵
        
        PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
      4⤵
      PID:10396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
      4⤵
      PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        9⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        9⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        9⤵
        
        PID:18232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        8⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        8⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51246.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        7⤵
        
        PID:16952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16952 -s 464
        8⤵
        Program crash
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        7⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23174.exe
        8⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        8⤵
        
        PID:16312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16312 -s 464
        9⤵
        Program crash
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
        7⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        7⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46430.exe
        6⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61560.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
        6⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        8⤵
        
        PID:18064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        7⤵
        
        PID:16164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16164 -s 452
        8⤵
        Program crash
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        6⤵
        
        PID:16788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9037.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
        5⤵
        
        PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        8⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        8⤵
        
        PID:18056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        7⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        7⤵
        
        PID:17536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6822.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
        6⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        7⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        7⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 452
        8⤵
        Program crash
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        6⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        5⤵
        
        PID:16920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        6⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        5⤵
        
        PID:17540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        5⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        5⤵
        
        PID:424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42862.exe
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
      4⤵
      PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
      4⤵
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
      4⤵
      PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
      4⤵
      PID:17636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50027.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        6⤵
        
        PID:17740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        7⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        6⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        5⤵
        
        PID:17492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        6⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
      4⤵
      PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56052.exe
        5⤵
        
        PID:18116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
      4⤵
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
      4⤵
      PID:16836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16836 -s 460
        5⤵
        Program crash
        
        PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53501.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        7⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        7⤵
        
        PID:17376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 648
        6⤵
        Program crash
        
        PID:9580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 648
        6⤵
        Program crash
        
        PID:9336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 724
        5⤵
        Program crash
        
        PID:4140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 772
        5⤵
        Program crash
        
        PID:7460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 740
      4⤵
      Program crash
      PID:5764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 768
      4⤵
      Program crash
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        5⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        5⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        5⤵
        
        PID:16436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
      4⤵
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
      4⤵
      PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
    3⤵
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59312.exe
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
      4⤵
      PID:11804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
      4⤵
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      4⤵
      PID:16564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
    3⤵
    PID:8640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
    3⤵
    PID:11600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
    3⤵
    PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
    3⤵
    PID:18392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
    3⤵
    PID:18360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
    3⤵
    PID:16596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51648.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22064.exe
        7⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe
        9⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        9⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39531.exe
        9⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        9⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64340.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        8⤵
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38781.exe
        9⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        9⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        9⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        8⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        8⤵
        
        PID:17768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40452.exe
        7⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        7⤵
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17677.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64397.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        9⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        8⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        8⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        8⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        7⤵
        
        PID:15624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15624 -s 452
        8⤵
        Program crash
        
        PID:18044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        7⤵
        
        PID:17880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        7⤵
        
        PID:17624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17624 -s 436
        8⤵
        Program crash
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        6⤵
        
        PID:16960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        6⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        8⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        8⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30685.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4346.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61851.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2403.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        6⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
        5⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        7⤵
        
        PID:17936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        6⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        6⤵
        
        PID:17944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        5⤵
        
        PID:15392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50916.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        6⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50624.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        8⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        8⤵
        
        PID:17600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47895.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        7⤵
        
        PID:18104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17219.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        7⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        7⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        7⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63799.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        6⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
        5⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17677.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22592.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2810.exe
        7⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        6⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8670.exe
        6⤵
        
        PID:18292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        6⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        5⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        5⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        6⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        6⤵
        
        PID:18036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
        5⤵
        
        PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
      4⤵
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        6⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8670.exe
        5⤵
        
        PID:17960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15898.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        5⤵
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
      4⤵
      PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
      4⤵
      PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
      4⤵
      PID:17504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12847.exe
        6⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        8⤵
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        7⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17728.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
        7⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        7⤵
        
        PID:16644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16644 -s 436
        8⤵
        Program crash
        
        PID:17900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
        6⤵
        
        PID:15412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15412 -s 460
        7⤵
        Program crash
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        5⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        7⤵
        
        PID:17948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57934.exe
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        6⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12371.exe
        5⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        5⤵
        
        PID:18288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
        7⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
        5⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        6⤵
        
        PID:17596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        5⤵
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        6⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32500.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exe
        5⤵
        
        PID:16448
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16448 -s 464
        6⤵
        Program crash
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        5⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31195.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
      4⤵
      PID:9832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17574.exe
      4⤵
      PID:12092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
      4⤵
      PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exe
      4⤵
      PID:18188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        7⤵
        
        PID:18300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34727.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        6⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        6⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6454.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        6⤵
        
        PID:16852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16852 -s 436
        7⤵
        Program crash
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        5⤵
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
        5⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        5⤵
        
        PID:15688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10394.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49915.exe
        5⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18871.exe
        5⤵
        
        PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
      4⤵
      PID:12908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
      4⤵
      PID:16348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        6⤵
        
        PID:16984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11542.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        5⤵
        
        PID:18060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
      4⤵
      PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
      4⤵
      PID:16288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe
    3⤵
    PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        5⤵
        
        PID:17844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17844 -s 452
        6⤵
        Program crash
        
        PID:16436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
      4⤵
      PID:11796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
      4⤵
      PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
      4⤵
      PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
    3⤵
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
    3⤵
    PID:9924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47234.exe
    3⤵
    PID:11772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
    3⤵
    PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
    3⤵
    PID:6524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        8⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57767.exe
        8⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
        8⤵
        
        PID:16512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16512 -s 460
        9⤵
        Program crash
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36179.exe
        7⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        7⤵
        
        PID:17980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17980 -s 452
        8⤵
        Program crash
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        7⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        7⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        7⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        6⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        5⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        5⤵
        
        PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12054.exe
        7⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8925.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        6⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        6⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        5⤵
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59856.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        5⤵
        
        PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        5⤵
        
        PID:18196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        5⤵
        
        PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32810.exe
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
      4⤵
      PID:11696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
      4⤵
      PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
      4⤵
      PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
      4⤵
      PID:17864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33389.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        6⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        5⤵
        
        PID:16700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15866.exe
        5⤵
        
        PID:16664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
      4⤵
      PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
      4⤵
      PID:13960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
      4⤵
      PID:17180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        5⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        5⤵
        
        PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40343.exe
      4⤵
      PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
      4⤵
      PID:18068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
      4⤵
      PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
      4⤵
      PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
      4⤵
      PID:17608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61134.exe
    3⤵
    PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
    3⤵
    PID:10528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
    3⤵
    PID:14280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7078.exe
    3⤵
    PID:408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 476
      4⤵
      Program crash
      PID:18356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8351.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        7⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        7⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
        7⤵
        
        PID:17592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
        6⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 436
        7⤵
        Program crash
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
        5⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        6⤵
        
        PID:15740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15740 -s 464
        7⤵
        Program crash
        
        PID:17956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39063.exe
        6⤵
        
        PID:17908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        5⤵
        
        PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        6⤵
        
        PID:17756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        5⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
      4⤵
      PID:10468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
      4⤵
      PID:13860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
      4⤵
      PID:17144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        5⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        6⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
        5⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
      4⤵
      PID:16688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
    3⤵
    PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
      4⤵
      PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35592.exe
      4⤵
      PID:3364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
    3⤵
    PID:8376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
    3⤵
    PID:11524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
    3⤵
    PID:15296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
    3⤵
    PID:18092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62730.exe
    3⤵
    PID:16552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
    3⤵
    PID:16272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        5⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
      4⤵
      PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
      4⤵
      PID:16904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6822.exe
    3⤵
    PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        5⤵
        
        PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8570.exe
      4⤵
      PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
      4⤵
      PID:15660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15660 -s 448
        5⤵
        Program crash
        
        PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
    3⤵
    PID:7856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58775.exe
    3⤵
    PID:8680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
    3⤵
    PID:13444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
    3⤵
    PID:16604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
    3⤵
    PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12222.exe
        5⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
      4⤵
      PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
      4⤵
      PID:17536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
    3⤵
    PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
      4⤵
      PID:14856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14856 -s 464
        5⤵
        Program crash
        
        PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
      4⤵
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
    3⤵
    PID:13196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe
    3⤵
    PID:16824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
  2⤵
  PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
    3⤵
    PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
    3⤵
    PID:12928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
    3⤵
    PID:16588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
  2⤵
  PID:7840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
  2⤵
  PID:10896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
  2⤵
  PID:14196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
  2⤵
  PID:16808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1664 -ip 1664
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1664 -ip 1664
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 936 -ip 936
1⤵
PID:7064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 936 -ip 936
1⤵
PID:8152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6036 -ip 6036
1⤵
PID:9000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6036 -ip 6036
1⤵
PID:9148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 16268 -ip 16268
1⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 15740 -ip 15740
1⤵
PID:17852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 14856 -ip 14856
1⤵
PID:17860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 15624 -ip 15624
1⤵
PID:17884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 15372 -ip 15372
1⤵
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 15728 -ip 15728
1⤵
PID:17540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 15412 -ip 15412
1⤵
PID:5184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 308
  2⤵
  - Program crash
  PID:17976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 16416 -ip 16416
1⤵
PID:17992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 16364 -ip 16364
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 15644 -ip 15644
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 16320 -ip 16320
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 16824 -ip 16824
1⤵
PID:17828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 16332 -ip 16332
1⤵
PID:17944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 15448 -ip 15448
1⤵
PID:17804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 16436 -ip 16436
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 16920 -ip 16920
1⤵
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 16476 -ip 16476
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 16312 -ip 16312
1⤵
PID:18296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 16952 -ip 16952
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 16772 -ip 16772
1⤵
PID:16684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 16700 -ip 16700
1⤵
PID:17668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 16908 -ip 16908
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 16744 -ip 16744
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1192 -ip 1192
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 408 -ip 408
1⤵
PID:16496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2808 -ip 2808
1⤵
PID:16632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 16932 -ip 16932
1⤵
PID:18032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 16768 -ip 16768
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 16808 -ip 16808
1⤵
PID:17484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 17600 -ip 17600
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 17844 -ip 17844
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 18012 -ip 18012
1⤵
PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 17624 -ip 17624
1⤵
PID:6212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 17928 -ip 17928
1⤵
PID:17552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe

Filesize
468KB

MD5
9fadabce7331e520f033811ced13346c

SHA1
03bbd86aecbcbfa43aa16cf2defb068466eb6747

SHA256
a7ecef55fcb02581895b22564d62a53cd12038e93df3ea8a3c8d272a715ecaf7

SHA512
7642e90b42577236f48ea5b33673883da34b948ec57ac7dddac900fcbdf5a3adc7de7d4efbc68c09cf59883824885a3a31783c02a0b9b021fcf2d20bdb9b7677

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe

Filesize
468KB

MD5
d55330ae3a9d91f529cbae29f1831767

SHA1
525e05ea7e40bf90cd052b3bd7bca8c83fe202a2

SHA256
0fa8ea5380ddf2b9a4f2ceee5e4e3d8054a7933285a31746b44eb90ce67813d4

SHA512
0c00a73f62df9f2f955da5e7936870bbecd455672cccc83b23bfb4de1fb6e9ecb3c86451d3f1eac18a4ccb7665513eed530dce96bf1101f43a7117b51e28fc95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe

Filesize
468KB

MD5
c58605aa0b85804e537993d82dbda62d

SHA1
9959598d780216ab3243f15570bb1497d18365a1

SHA256
80c0c2330984e98a8da55a0d01a612d5747d4df87b71d138ba58957b2f05221d

SHA512
feaa7f7b0d1b6360a7a6e1673f02b2de8bfe576ffee164a0f5ba6e5e8c1c2d1a1f4bf9068fbdd824bfe48525bb5dcc91c01ce58ec120364d2999f4466e37d662

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe

Filesize
468KB

MD5
4b3ba3273325bfb1ad33a9d159be7e71

SHA1
8f870a4ec76b31d77a00fc6ad8d12148e2191990

SHA256
90ccaa91cffe887e0e7cf8dc4ab8d9dc937f3fa9d8a0ed5a81e6002e330a45cf

SHA512
c5aa141cada6179fef141c35ec23397da94732327e59c7c1c3c624908ed13379a98f9c8dd2096685e14767f684a62a8ef5ec0dd39a5927e29cb1d01c23beef0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe

Filesize
468KB

MD5
57e0c5648bac39194fd4b180925f4e7b

SHA1
1d7c0d2a503be402cfe770b620412ec67daf9f0a

SHA256
d04fa739fea359e8e0ef2929076654489b4987b7e70e16e1b01a966a41148874

SHA512
51e60c6b81311bbb0d00f6d33efba2a7f00bba0918caacd9552d47ec193c4c631026c228ae20ce35a4dd2e6d48d0bc26b2463738f0e06cfb773cc8f6a11ab213

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20605.exe

Filesize
468KB

MD5
420bb9bd690e03f55f7941afbd187327

SHA1
45068ff5ac5444a847c5f00541a1817ba0a63ca9

SHA256
f9bf8956487f2daedcd681edcb3e26ccc128bc571fbc72417b2db79891264444

SHA512
742a5e19e5ee0bdddac222562663679cb8ae215b83b1a2ffbf587cd70e518382b144d91cae983107e42d9a88331f18e463b4ed032836d7c39c614c707d95ad00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe

Filesize
468KB

MD5
869efa5525a564dbfe89476665175542

SHA1
65cbb477b028af326cd5cf9d8410cb9574469d37

SHA256
0470b0bf94d468445d416e371820260501577289da4b468bee0e1db2fae6a62b

SHA512
365b40ecb099f762a0544fe4dbd8aaca7057188c56ffde72678ce6f6cde67f430e1d96888695e8ab7b1dfa8efdbd2e8f7921094fb016042c124cac607d7b46eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe

Filesize
468KB

MD5
9fee2b1524db17dd6345964adf67d990

SHA1
0adeee69fdf5ed8f655ac78168bb46aad2ae6422

SHA256
f10fec83a409a982549f3e873858080156d75312e900e72462d40ccf8b570545

SHA512
c9fef315bdbfa739b231dc95c2a47676bc4c3138c1667f8dd7cc495ff9b057093a2290b298035c7e6a963ec47f258edd09b2220fb4df6b9be2c73558d900559a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe

Filesize
468KB

MD5
5e9471246d95d291dbb135e4106ae5a0

SHA1
eb1ab48a370791879b65e90fbac12f7931d14c46

SHA256
56288f59a0118f40b9245b627bf05d990372f43a266ec291bc06173218543c87

SHA512
90540451b283b0c932b1176ed008142b71d955c33814b81b85b9f1cbd3e7d2307a8738e9f73cf46079203927c6d22753bd9940a558ce260adb8f22684b90d993

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe

Filesize
468KB

MD5
1ffcbc6e4ffec6a362dd441584a461c0

SHA1
591b9a3a4efab4ca01bc956fb06aa3f10d4be0b0

SHA256
85808a1b6935a316078e71734c9b8d747a1dab694e86ce2f03102fef4a9f45ef

SHA512
f79ad2a391190f0707081605dee83971ad8092ec6c4e679158c6d3b846b2d2ef247c08a6807710de44fdc5c7188637d675e4a9da74af7be29702a6c0a3a9d3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe

Filesize
468KB

MD5
b9e2518f34572bad76197715ed4b60ad

SHA1
748baa67e57374fd13700f81bf8b59bd9ecca3b2

SHA256
cb982bf6d32864de6be01b8598721eca35b878d2f155060525d88f4e13b850c1

SHA512
23f23fa6286715551db381fc4cbabc8708e37cee1d69f2626ad6fb71164afd9ae8809a37fc8edcf0c72ce969d4115536264114e5c0d8c90d5657efcb4284fd7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe

Filesize
468KB

MD5
da41b2e315cf762d1fd804929319897b

SHA1
8d8bb3894c38a52fbae74aa987b4598c403dcb70

SHA256
56fff6b07e0ea9052a446dc7e5afe7b9a9806890e9dadff4966e0e4692f849cd

SHA512
c52e19cfe4ec794757ee29dab0b81409c6d0d54bb224c28fc2a0fed26e9f01bca2f8fd9c632f2c766f4e74c6b93b42dfdc7e9abbbff4964087e417b0de54c644

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe

Filesize
468KB

MD5
fbffb13b571bba3f776e03c1f00f5cfd

SHA1
1dbe0550ed9f39de2a9a35e2582b28b5253155ed

SHA256
06d15e255ab8cc84c05e97f74cbc7ec5a142f3d5bb7690e470d9871f9c4cc4d2

SHA512
3f57a32b210059ab33046cfc8002d711612d757d987aa37c8e054a79728f1f20e70d8eee1f03af05b31770173a934a3fa7ae76419169ac8332057619e313edc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe

Filesize
468KB

MD5
ac6005596be39ebf188273329fe5513f

SHA1
3a072d598bdc2fa007f6ab3395e5f831e7aa55cf

SHA256
05171665bfecbdd66f2e30ec06d62aa713c26ba62274fd60dbb5d5bb6dce8dcb

SHA512
a6f432bd031aeb3686927d3beefb2909584d2a3a85723ed549ea8f382697bae76251e3dc809339e2e40a7f52fec9d3ed501f1a88cb5c4b262cb74545df5e2c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe

Filesize
468KB

MD5
f3e6c118b0caf29ae3253eddc6231baf

SHA1
4cc89aa4b34e3a50f4e486dcb6e8689aa49e8d11

SHA256
c604d9b1e78948373529b5490eb16af498c3099f0f27dd7023f753dd6dc34e17

SHA512
fea6b955d4e8fb13982cf2263165b4d053b2f0e08f3b731c22a9d1fd9fd56b4dcfd4349afda351490bb9cd6ee3b8d53129ed3f249de599deabf497b9d4c83a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe

Filesize
468KB

MD5
f9f78b54c02218a5bce39168236906e7

SHA1
ab679ff741e45d2a3fad8c1a401dbef15f6b6c8f

SHA256
433c79b42d426afd07430d96a2354bf32a0f84ac5b2619e1521b5e874d14f459

SHA512
e59a8529e68812b8ada1d716eb7250a57d3368525c21fc84b0daaea57fd1451155b7b196731214833f7659ea712956ed1754f72c02e6507e9f758e7d5b624b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe

Filesize
468KB

MD5
c1e50453c534aa63dad930ce4901a836

SHA1
dd5cb126ba17d8e2f8d71c577ebb1a68ef604991

SHA256
33019f9dee2b9ce1c4acf7fa1ee70c8853ba524e10471b5cf12272b6e45fa7fc

SHA512
9edac093a55d8f55280fbc5492232b6eae270688b699dbce9ba2e2ac6f1eb7e6867fb0bf069fc6aeb5d5f473c8f8325069db1d2bef48c4257e0ccafb68c5da05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe

Filesize
468KB

MD5
1426c3c29d6857c2d5c42a6dd4c5754e

SHA1
6950a1896217b0d6286a016bfcf477380c4ff623

SHA256
7fb6cb1e52cf8f8fabec040eb23a34bf55259e526ea173dcf8e41807d1e53b13

SHA512
601fd59493ed4fda2fd0feeceb033ec28a63483aabc2ade7e168a3e9ac3670f33e991ac3b15c8cf95164ddab21f5209d9dd06c3e079dbf87e7045f84be1c3f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe

Filesize
468KB

MD5
ca3856c3ec347f360d1612bef3b4317d

SHA1
3347c048956a560527b96287f933e5d6c4b46b12

SHA256
894a9196bce96fb50e5f1795b427c90192889e4e7db56feeae1b67fe3ece0a77

SHA512
b5bb2c649a56fa9e7cccc9882eed9463ffbf84131aacd49dbc535be1a8314abc004db76af6baa09d610d215dfd0af45679847dda83ff4958efe75356d9d89200

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe

Filesize
468KB

MD5
452adf45657078ae0c787a79cf4078bd

SHA1
c9aa1ad9b886e01fd4a8eb63ebdc400233f37ea4

SHA256
c70ece7ba614d89a5cd015a02084bf98430d1a8b644d81d53123d1f22622a9c2

SHA512
83b405d3f001d9fce512ec6f429e9b9aaa754616218dfd971c70887ddc1cdbcb18ca1ce26f4ad1596f25e86a7bbd3310e23ca3f58cf26488793986189db003e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe

Filesize
468KB

MD5
16f19335e14707037895f7d7754228a5

SHA1
9907c5ec4e2281a98e32a4b8e07fc5114e8e2a10

SHA256
04beb0b09da060acfebc5939a1b568135929af6e7e0f7dc845453f1c1bb6c464

SHA512
c18e291cc4f8d70790e3d80e9b66013144dc1c298846b59791b29aed37c00a3d61f05dd2725d4850b54327a3fd3e5376fc468bd97da6ad4f01515826e5604c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50027.exe

Filesize
468KB

MD5
837bb68ac4267a7533d28216caf3bb77

SHA1
ab4e430bfcd366f8bf470fe9c5d4f2f9089fdf50

SHA256
95328fd21e92044ed945ca6cc2e30f4f17fde766bbf80cb9f5b76a216655f913

SHA512
5453e4bf832971ae0ee520ffe132d9fe89854321976a556314c934e39eaaa5e43bcd8b4bd7e84cb20db51f363ea49101952f60b9765c621bb8e89ba839e103d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50916.exe

Filesize
468KB

MD5
3a5ce48d607e7825f63120f76cbfcac9

SHA1
f2e3e387a6a18c2e0904e1e4c41822e9841e88ca

SHA256
9eefb0a2714f7cdf890196d916563f482afba54d632068cced31a32fa5279ea8

SHA512
f867658e031206a6ddc66a8aa7c8adc320c6b4135a363e91f4d9ed458d6dc85cb29a12f6fe4dc944db5b42c9cf664285048f6a3288135d1a2be62558e8e47efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51648.exe

Filesize
468KB

MD5
36264f9facaaea1a092256beb7437bb9

SHA1
17951fd5b65b9441be255b0bcc5c425fac3ae432

SHA256
d59ce6d05f27487363de42dc7231572e99992f47790909eb0ded267eb46fa90d

SHA512
160dc2152414db8bdb55a616a697e6914d8638bbf4e56932f20656b2da108bf330e8dfdc7d045428abc50fa628490aeac2787ff5a728c6799c9fc99d0d8ff5ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe

Filesize
468KB

MD5
d4a01304f81557212659f5a970148d03

SHA1
0b1c6d50e78473ab2c73bbe4ffb8ca9c6f9e35a0

SHA256
020624545dda7025de5cb5c828987c036546017402f2423ca92f36fc37490562

SHA512
0f15cd4a0169c9d970920f2f0f3f24f61173dd50b9c67490d7435ed06307aa35fa26cce31951de333e0167e1bb9ae420e3bd86abcc19f63c9e16ec7b37afbffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe

Filesize
468KB

MD5
8a41d4d15899447ff4c81d8c0707512b

SHA1
88d4e2cc734c12e6136dcdd4bd13f8309a4801f0

SHA256
26f7541be891a606dde1db95baa71a72208298138e2c9cda0ab375948dd5b358

SHA512
bdb9303d7301f1db079c12ee2a899cee59b3fdf1192452163948bbcf65d30304af101d57050222a71d6f51b8f2ab467127e8ee2110113c26492d6c82db90d4f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe

Filesize
468KB

MD5
caaecb7de1e2ba61182f4417c790f173

SHA1
1c0d3c156cfd97d5acc1c3a11d73b8093e6ded1e

SHA256
2805ac3d443cde82d2d06e49ccb8f948e07ed7115b3634991d929c05ba69f588

SHA512
84c46c7131e51a2c470c8799fed93d326d05d51c5bb7ead8ff03dbb77f2010b38d1bc83fd7e5306c29315af431a1dafddd24b037d8375ba6ae1d2ad62850fb48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe

Filesize
468KB

MD5
6a536673d815729c96dedd530bf9a337

SHA1
548f64b5fe161356c89daa4f6627dd191978a0d5

SHA256
3f715b0655cf3f80866b602dec40fcd57fc209f3a7a1f3700c2f42605cf1fc27

SHA512
1901cdf2eef6bfef1c9f974efb4cc23343309d29473fc0ea5132802b7af57b7122d5785bd29f810fa951fe5b2719c7a1fba5dbb71fd19c381f034e3000c85b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64340.exe

Filesize
468KB

MD5
697f9b901ea279b2986ff73671b2679d

SHA1
8273b6d73ccbe386d41b5895ebb68ef530fadc0b

SHA256
e4d0b2fae40e19427efb7c7db5cbdf3c11d3c2696ee6f513f4bd003989109847

SHA512
8b7a9905969b3fd02bc869ef7f9407433e467883b29c0c9ad7260dd12a534b6fb8cbd55f29c6d87b1f7efc2c0f44fb446dd81cc41d6657c70b3617534387ad78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe

Filesize
468KB

MD5
de31957833e217dac196e4c181abb4f1

SHA1
03711e6564d336b49ef3bfee7277d240e78e4e31

SHA256
88e71e54a2b365762f2b341547986adbad711c4e91f006a4303563348ed5c065

SHA512
9f1f3e00b1fad86c6bda3ec958a45c63f3bc7d29bb6b54dee2005453c57ca469bf26765bc0dbab561719c5e546e5e999c1c58eaf823b382a3f84527f6d4592f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe

Filesize
468KB

MD5
a63316ee668a56a01624e0b839d36edd

SHA1
22d1990734aec930cd326b2adcf3c700d4226737

SHA256
f58e5ab4d0db7415c12c8262651cafa43ed4079135ab7ff5fdde5a6ce7baa0b9

SHA512
184d57997be54d00fc1b5490827aa4c677430d8a68798a559ccdb142ff850b3f7ad191678c8304503f3907cdbd04742804715eb3700a40a755bff0190cf1550d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe

Filesize
468KB

MD5
5324f21e5832627d25c9bdf65f23f71e

SHA1
99324ca9e5b268d6eb8b8f1465283870266c8995

SHA256
091e1a18b3f1495d0bb00161e666d1967259b3ca49e3423d1838cd8abd13a607

SHA512
5418c4077a0dee13715ade98bb0c2a3ee27e9acc9a357758bba8f66dcd6d214f2209b06517a056356e83441102dc4e5eb922d7a08ebfb3561c6a59a1fba41903

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe

Filesize
468KB

MD5
7b7c2fd647f05f1a7f4572078bd91e28

SHA1
d306951ab276ebc463d88a03aa0553a7f4ae38bc

SHA256
bf1e1bafe62414bb3ea741511d4e5652a342f05d9425a3186e5b956fe087c7f7

SHA512
79231fe63bcbb0749c967308d09070759e1105df04b2f27bb7160856ef8e13f7d348cf4b0b76eb6e3d03c8386280d25cad6f00e507fd35a6c7034538d44e777a

Download Submit
memory/4548-3315-0x00007FFBC43F0000-0x00007FFBC45E5000-memory.dmp

Filesize
2.0MB

Download
memory/6388-3469-0x0000000075560000-0x0000000075700000-memory.dmp

Filesize
1.6MB

Download
memory/16588-3438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17864-2873-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download