0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3

Analysis

max time kernel
134s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe
Size

468KB
MD5

52b097ea6525becc180a2a68450cc72f
SHA1

2df9a918333f23a511da7571158469927364834d
SHA256

0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3
SHA512

a20acf390cc8e152ec290a3ba2329ce1ac78df7d33d4457ba0fbdba58949bba0c792e01bb29d90533a596a4eccce21c0e99e8d91f940998228eec44728abd85b
SSDEEP

3072:wTANoSCVId5NtbYfPztjcf8/SCMbPgpwVmHeWvtUMKD8bVyCQHlF:wTqoQbNtYPJjcfHcQ5MKwxyCQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1808	Unicorn-15678.exe
60	Unicorn-55688.exe
3736	Unicorn-39906.exe
2484	Unicorn-28828.exe
1080	Unicorn-17130.exe
3264	Unicorn-43118.exe
2968	Unicorn-49248.exe
1872	Unicorn-37956.exe
4880	Unicorn-26258.exe
1072	Unicorn-39902.exe
1388	Unicorn-28204.exe
4468	Unicorn-17344.exe
224	Unicorn-50108.exe
3788	Unicorn-25247.exe
4148	Unicorn-64167.exe
4796	Unicorn-25294.exe
4876	Unicorn-14987.exe
5040	Unicorn-38100.exe
4964	Unicorn-33361.exe
4140	Unicorn-21018.exe
4664	Unicorn-27139.exe
3024	Unicorn-31900.exe
3612	Unicorn-44152.exe
2972	Unicorn-44152.exe
5032	Unicorn-43887.exe
5000	Unicorn-28370.exe
4012	Unicorn-48236.exe
2552	Unicorn-43390.exe
3520	Unicorn-5812.exe
2472	Unicorn-44920.exe
1172	Unicorn-42874.exe
2008	Unicorn-50950.exe
4412	Unicorn-8526.exe
4568	Unicorn-49352.exe
2820	Unicorn-23264.exe
2360	Unicorn-34770.exe
4416	Unicorn-15017.exe
4496	Unicorn-31262.exe
3392	Unicorn-8438.exe
1616	Unicorn-45460.exe
1688	Unicorn-14733.exe
1428	Unicorn-30805.exe
2188	Unicorn-11204.exe
4844	Unicorn-4427.exe
908	Unicorn-8511.exe
4196	Unicorn-41276.exe
456	Unicorn-51490.exe
336	Unicorn-21532.exe
3960	Unicorn-25616.exe
620	Unicorn-41952.exe
3628	Unicorn-27562.exe
952	Unicorn-27562.exe
3956	Unicorn-11780.exe
956	Unicorn-64410.exe
5124	Unicorn-50675.exe
5176	Unicorn-1474.exe
5184	Unicorn-1474.exe
5208	Unicorn-30684.exe
5248	Unicorn-64318.exe
5288	Unicorn-6187.exe
5292	Unicorn-15117.exe
5328	Unicorn-57831.exe
5364	Unicorn-19756.exe
5412	Unicorn-51874.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
9112	6848	WerFault.exe	243
10080	6856	WerFault.exe	244
9908	6864	WerFault.exe	245
10108	6828	WerFault.exe	241
10108	6872	WerFault.exe	246
7268	13888	WerFault.exe	723

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57831.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe
1808	Unicorn-15678.exe
60	Unicorn-55688.exe
3736	Unicorn-39906.exe
2484	Unicorn-28828.exe
2968	Unicorn-49248.exe
1080	Unicorn-17130.exe
3264	Unicorn-43118.exe
1872	Unicorn-37956.exe
4880	Unicorn-26258.exe
1072	Unicorn-39902.exe
1388	Unicorn-28204.exe
3788	Unicorn-25247.exe
224	Unicorn-50108.exe
4148	Unicorn-64167.exe
4796	Unicorn-25294.exe
4876	Unicorn-14987.exe
5040	Unicorn-38100.exe
4964	Unicorn-33361.exe
4140	Unicorn-21018.exe
4664	Unicorn-27139.exe
2972	Unicorn-44152.exe
3024	Unicorn-31900.exe
3520	Unicorn-5812.exe
5032	Unicorn-43887.exe
2552	Unicorn-43390.exe
3612	Unicorn-44152.exe
5000	Unicorn-28370.exe
4012	Unicorn-48236.exe
2472	Unicorn-44920.exe
1172	Unicorn-42874.exe
4412	Unicorn-8526.exe
2008	Unicorn-50950.exe
4568	Unicorn-49352.exe
2820	Unicorn-23264.exe
2360	Unicorn-34770.exe
4416	Unicorn-15017.exe
4496	Unicorn-31262.exe
3392	Unicorn-8438.exe
1616	Unicorn-45460.exe
1688	Unicorn-14733.exe
2188	Unicorn-11204.exe
1428	Unicorn-30805.exe
4844	Unicorn-4427.exe
4196	Unicorn-41276.exe
908	Unicorn-8511.exe
456	Unicorn-51490.exe
336	Unicorn-21532.exe
3960	Unicorn-25616.exe
620	Unicorn-41952.exe
3628	Unicorn-27562.exe
956	Unicorn-64410.exe
952	Unicorn-27562.exe
3956	Unicorn-11780.exe
5124	Unicorn-50675.exe
5176	Unicorn-1474.exe
5184	Unicorn-1474.exe
5248	Unicorn-64318.exe
5288	Unicorn-6187.exe
5208	Unicorn-30684.exe
5328	Unicorn-57831.exe
5292	Unicorn-15117.exe
5364	Unicorn-19756.exe
5428	Unicorn-21916.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1808	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	95
PID 4860 wrote to memory of 1808	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	95
PID 4860 wrote to memory of 1808	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	95
PID 1808 wrote to memory of 60	1808	Unicorn-15678.exe	99
PID 1808 wrote to memory of 60	1808	Unicorn-15678.exe	99
PID 1808 wrote to memory of 60	1808	Unicorn-15678.exe	99
PID 4860 wrote to memory of 3736	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	100
PID 4860 wrote to memory of 3736	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	100
PID 4860 wrote to memory of 3736	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	100
PID 60 wrote to memory of 2484	60	Unicorn-55688.exe	102
PID 60 wrote to memory of 2484	60	Unicorn-55688.exe	102
PID 60 wrote to memory of 2484	60	Unicorn-55688.exe	102
PID 1808 wrote to memory of 1080	1808	Unicorn-15678.exe	103
PID 1808 wrote to memory of 1080	1808	Unicorn-15678.exe	103
PID 1808 wrote to memory of 1080	1808	Unicorn-15678.exe	103
PID 4860 wrote to memory of 3264	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	104
PID 4860 wrote to memory of 3264	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	104
PID 4860 wrote to memory of 3264	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	104
PID 3736 wrote to memory of 2968	3736	Unicorn-39906.exe	105
PID 3736 wrote to memory of 2968	3736	Unicorn-39906.exe	105
PID 3736 wrote to memory of 2968	3736	Unicorn-39906.exe	105
PID 2484 wrote to memory of 1872	2484	Unicorn-28828.exe	108
PID 2484 wrote to memory of 1872	2484	Unicorn-28828.exe	108
PID 2484 wrote to memory of 1872	2484	Unicorn-28828.exe	108
PID 60 wrote to memory of 4880	60	Unicorn-55688.exe	109
PID 60 wrote to memory of 4880	60	Unicorn-55688.exe	109
PID 60 wrote to memory of 4880	60	Unicorn-55688.exe	109
PID 2968 wrote to memory of 1072	2968	Unicorn-49248.exe	110
PID 2968 wrote to memory of 1072	2968	Unicorn-49248.exe	110
PID 2968 wrote to memory of 1072	2968	Unicorn-49248.exe	110
PID 3736 wrote to memory of 1388	3736	Unicorn-39906.exe	111
PID 3736 wrote to memory of 1388	3736	Unicorn-39906.exe	111
PID 3736 wrote to memory of 1388	3736	Unicorn-39906.exe	111
PID 3264 wrote to memory of 4468	3264	Unicorn-43118.exe	112
PID 3264 wrote to memory of 4468	3264	Unicorn-43118.exe	112
PID 3264 wrote to memory of 4468	3264	Unicorn-43118.exe	112
PID 1808 wrote to memory of 224	1808	Unicorn-15678.exe	113
PID 1808 wrote to memory of 224	1808	Unicorn-15678.exe	113
PID 1808 wrote to memory of 224	1808	Unicorn-15678.exe	113
PID 4860 wrote to memory of 3788	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	114
PID 4860 wrote to memory of 3788	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	114
PID 4860 wrote to memory of 3788	4860	0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe	114
PID 1080 wrote to memory of 4148	1080	Unicorn-17130.exe	115
PID 1080 wrote to memory of 4148	1080	Unicorn-17130.exe	115
PID 1080 wrote to memory of 4148	1080	Unicorn-17130.exe	115
PID 1872 wrote to memory of 4796	1872	Unicorn-37956.exe	116
PID 1872 wrote to memory of 4796	1872	Unicorn-37956.exe	116
PID 1872 wrote to memory of 4796	1872	Unicorn-37956.exe	116
PID 4880 wrote to memory of 4876	4880	Unicorn-26258.exe	117
PID 4880 wrote to memory of 4876	4880	Unicorn-26258.exe	117
PID 4880 wrote to memory of 4876	4880	Unicorn-26258.exe	117
PID 2484 wrote to memory of 5040	2484	Unicorn-28828.exe	118
PID 2484 wrote to memory of 5040	2484	Unicorn-28828.exe	118
PID 2484 wrote to memory of 5040	2484	Unicorn-28828.exe	118
PID 60 wrote to memory of 4964	60	Unicorn-55688.exe	119
PID 60 wrote to memory of 4964	60	Unicorn-55688.exe	119
PID 60 wrote to memory of 4964	60	Unicorn-55688.exe	119
PID 1388 wrote to memory of 4140	1388	Unicorn-28204.exe	120
PID 1388 wrote to memory of 4140	1388	Unicorn-28204.exe	120
PID 1388 wrote to memory of 4140	1388	Unicorn-28204.exe	120
PID 3736 wrote to memory of 4664	3736	Unicorn-39906.exe	121
PID 3736 wrote to memory of 4664	3736	Unicorn-39906.exe	121
PID 3736 wrote to memory of 4664	3736	Unicorn-39906.exe	121
PID 224 wrote to memory of 3024	224	Unicorn-50108.exe	122

C:\Users\Admin\AppData\Local\Temp\0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe
"C:\Users\Admin\AppData\Local\Temp\0904e5f8e8bed8b1f8f8b3a7b19a3979710ecb19a7849c595e72d01c52fb1da3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56892.exe
        9⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        10⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        10⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        10⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        10⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        9⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        9⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        9⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
        9⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        9⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        9⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
        8⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
        9⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        9⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe
        9⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        9⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        9⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        9⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        9⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        8⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        7⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
        7⤵
        Executes dropped EXE
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        9⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        9⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        9⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        8⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        7⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        9⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        9⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4535.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        7⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11510.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        7⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        7⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        7⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        9⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
        9⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        9⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32983.exe
        9⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        8⤵
        
        PID:100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        7⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 632
        8⤵
        Program crash
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38676.exe
        7⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        7⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41328.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        9⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        9⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
        8⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53965.exe
        7⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        8⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        7⤵
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        6⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        8⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60187.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        7⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        7⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        6⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 688
        7⤵
        Program crash
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55055.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        6⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        6⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        8⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        8⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
        7⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54531.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
        6⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        6⤵
        
        PID:14996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49483.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32809.exe
        5⤵
        
        PID:9936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        9⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        9⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        9⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe
        9⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        9⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        8⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        7⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6864 -s 604
        8⤵
        Program crash
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        7⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        7⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36166.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28822.exe
        8⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        7⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        7⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44107.exe
        6⤵
        
        PID:17548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48863.exe
        6⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        8⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        7⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        7⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        7⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        6⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        6⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        7⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        6⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        7⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55163.exe
        6⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        7⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        7⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25427.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        6⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        5⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe
        5⤵
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65086.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        8⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21497.exe
        7⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        6⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 608
        7⤵
        Program crash
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        6⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-742.exe
        6⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        7⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        7⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        6⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        7⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        6⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        5⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23919.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62924.exe
        5⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        5⤵
        
        PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        7⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37456.exe
        6⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        5⤵
        
        PID:6872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 608
        6⤵
        Program crash
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        5⤵
        
        PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        6⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31895.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        5⤵
        
        PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
      4⤵
      PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      4⤵
      PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        9⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        9⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        8⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        8⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        8⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        7⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        7⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        7⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50072.exe
        6⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        7⤵
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        6⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60015.exe
        7⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64567.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        7⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        7⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        7⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
        5⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46390.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        5⤵
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32533.exe
        5⤵
        
        PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        8⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        8⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        8⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        7⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        7⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        6⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        5⤵
        
        PID:17688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
        5⤵
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        6⤵
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        6⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
      4⤵
      PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        5⤵
        
        PID:14192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        5⤵
        
        PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
      4⤵
      PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
      4⤵
      PID:10108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        8⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        7⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        7⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        7⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        7⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
        6⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        6⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1345.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55494.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        6⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        5⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        7⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1630.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        6⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        5⤵
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45376.exe
        5⤵
        
        PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      4⤵
      PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        5⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        6⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        7⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32470.exe
        5⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        6⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        5⤵
        
        PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        5⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        6⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        6⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        5⤵
        
        PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
      4⤵
      PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        5⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        5⤵
        
        PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
      4⤵
      PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
      4⤵
      PID:8092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15474.exe
        5⤵
        
        PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
      4⤵
      PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
      4⤵
      PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
      4⤵
      PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
    3⤵
    PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
      4⤵
      PID:14288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
      4⤵
      PID:3316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
    3⤵
    PID:8284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
    3⤵
    PID:11244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
    3⤵
    PID:10748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2263.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        8⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        9⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        9⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        9⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        8⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        8⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1362.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        7⤵
        
        PID:14844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        7⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        7⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        7⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26040.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49855.exe
        6⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        7⤵
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        6⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
        6⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        6⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        5⤵
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        6⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        8⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        7⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        7⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        6⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46577.exe
        6⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        7⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        6⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
        6⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
        5⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        5⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49855.exe
        5⤵
        
        PID:13920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64410.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        7⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        6⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
        5⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        6⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        6⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31293.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        5⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55924.exe
        5⤵
        
        PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        5⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8185.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
      4⤵
      PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65060.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        9⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
        8⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33798.exe
        7⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34888.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        7⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
        6⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        7⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        6⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        7⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        7⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        6⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        6⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        5⤵
        
        PID:11608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        5⤵
        
        PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
        6⤵
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        5⤵
        
        PID:18104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
      4⤵
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
        5⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
        5⤵
        
        PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
      4⤵
      PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
      4⤵
      PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49050.exe
        7⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36008.exe
        7⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49190.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        6⤵
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39297.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
        5⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38676.exe
        5⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63451.exe
        5⤵
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        5⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        5⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        5⤵
        
        PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe
      4⤵
      PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exe
        5⤵
        
        PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
      4⤵
      PID:17676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
      4⤵
      PID:7716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        6⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13888 -s 440
        7⤵
        Program crash
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        5⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
        5⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        5⤵
        
        PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
      4⤵
      PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        5⤵
        
        PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      4⤵
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      4⤵
      PID:14836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
      4⤵
      PID:9820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
      4⤵
      PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11355.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe
      4⤵
      PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      4⤵
      PID:15308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
    3⤵
    PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
      4⤵
      PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
      4⤵
      PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe
    3⤵
    PID:11524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
    3⤵
    PID:2568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
    3⤵
    - Executes dropped EXE
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        6⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        7⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        7⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        6⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1251.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56337.exe
        7⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        6⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        6⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        6⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
        5⤵
        
        PID:15136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        6⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        5⤵
        
        PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
        5⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10042.exe
        6⤵
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        6⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        5⤵
        
        PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
      4⤵
      PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        5⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        5⤵
        
        PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
      4⤵
      PID:13012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
        6⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        6⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31205.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        5⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
        6⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        6⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        5⤵
        
        PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        5⤵
        
        PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
      4⤵
      PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
      4⤵
      PID:16512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        6⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        6⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        5⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
      4⤵
      PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        5⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
      4⤵
      PID:17656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
      4⤵
      PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25314.exe
      4⤵
      PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
      4⤵
      PID:4048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12077.exe
    3⤵
    PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63103.exe
    3⤵
    PID:11584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
    3⤵
    PID:15024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
    3⤵
    PID:10236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25247.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32990.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        6⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
        6⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        5⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        5⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        5⤵
        
        PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
        5⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
      4⤵
      PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
      4⤵
      PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
      4⤵
      PID:8348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        5⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        5⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        5⤵
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58714.exe
        5⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        5⤵
        
        PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56207.exe
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19193.exe
      4⤵
      PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
      4⤵
      PID:7996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
    3⤵
    PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
      4⤵
      PID:11424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
      4⤵
      PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
    3⤵
    PID:9148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23222.exe
    3⤵
    PID:13016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
    3⤵
    PID:15960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        6⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39050.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
      4⤵
      PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      4⤵
      PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
      4⤵
      PID:15420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
    3⤵
    PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe
      4⤵
      PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe
      4⤵
      PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
    3⤵
    PID:8256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
    3⤵
    PID:11232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
    3⤵
    PID:652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
    3⤵
    PID:7296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32954.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
      4⤵
      PID:16192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
    3⤵
    PID:8748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
    3⤵
    PID:11704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
    3⤵
    PID:17332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
    3⤵
    PID:7880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54330.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54330.exe
  2⤵
  PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
    3⤵
    PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35020.exe
      4⤵
      PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
    3⤵
    PID:9872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
    3⤵
    PID:9772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:17668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23860.exe
    3⤵
    PID:8032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
    3⤵
    PID:9972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
  2⤵
  PID:7952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
    3⤵
    PID:17232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
    3⤵
    PID:9580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
  2⤵
  PID:8692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
  2⤵
  PID:15096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
  2⤵
  PID:5580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4276,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 6848 -ip 6848
1⤵
PID:8244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6864 -ip 6864
1⤵
PID:8076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6856 -ip 6856
1⤵
PID:8656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6828 -ip 6828
1⤵
PID:9272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6880 -ip 6880
1⤵
PID:9524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6840 -ip 6840
1⤵
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6872 -ip 6872
1⤵
PID:11440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 13888 -ip 13888
1⤵
PID:7240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3888,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:2
1⤵
PID:8788

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:8804

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe

Filesize
468KB

MD5
531db5e2dedf6584a8c147251751db1f

SHA1
dddb62ee5b29775bac72d165b850770169d7b608

SHA256
438eb8b3c9fe9c110dc4e6063120120b71ac9795c745a67c9dd8525d345b32d4

SHA512
bdc0ea398f56f7d899284cbb4aac9638dba49b9709a2cb0b841fbeffe3efe8f1eb23426c7a6a86b28a5134b662c519c1576846988ac13ef5c4d99632b9b7eb9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe

Filesize
468KB

MD5
b156a680c684de0bc3771b71a606092f

SHA1
933386b5b7a98f22ee9389ce08fcf66c026d3325

SHA256
aa8c3f7cda96f24997edaa4c0bac21a4bf96d56df37e3ba7ae004a21c37e48ee

SHA512
9d2df37730ca0f56496b8312acac494117cbca9f0d850e8bf300c60820f8be7a977e721569e69ca22af74c58c3c0f0693330ab3e008fb49f6c58eb5439efb256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe

Filesize
468KB

MD5
8602f161f025cb13b59bc3b33bfb74ea

SHA1
3a26534336abad279790d851f70c6c0310a4bbaa

SHA256
a40fc3690484e34e578349cab2d69624f8892b31b97f1133e66be038d07f29b5

SHA512
b26d060cd2f1cd41031ea983de32200ed786b498574ddb51d0d499b9245853bd45a8314506f11b37687bbb6e5f5eca6b4c32d3fe1438deded3feb9b5152196d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe

Filesize
468KB

MD5
f2ed4c8fec49d6d1a7ac1ba558f76fd0

SHA1
dc0a78f38a8159020dc20a3ea479b3291fbb817a

SHA256
6c7a33b4b8b6869279aa8a703b2698538d5fe6e2f703b6a1d3167d69cb2ed5a6

SHA512
536478283373829777fce8b39c4968e5a6b605447f2813926be85938b21e7d1af58530980bf4c53cac569fd3181f49a4cdcc6cdbf81d199664d4d38a55c0c576

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe

Filesize
468KB

MD5
23a52af2e7d64cfd3c9e03dd09174253

SHA1
27909da05187512211c14285ce54542b9812e67b

SHA256
a0d096858ffb06d1e4312d30f5dea736b8947785a60b64d849b2d0cdc8db3edf

SHA512
e49960064f779b64f5a812ca6ff577ecbbc6a7b6fa5e3f916c65166342d96b080af93e041e65c4e44633fd1d598d5096cfc0f85031510ee8039d3296f519da73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25247.exe

Filesize
468KB

MD5
20f40abb111d7d1f35d6dc65c020ca55

SHA1
9dabdecbf99941b5749c0a11df6982141b571b00

SHA256
c7985f956764c0880d9d7840372698f28d4fdbce686460ab83156240dce4165f

SHA512
ae0ac00ae92cc8e440f694422b6cf21a2ee6eef5dbe372227690535d80b4d2af171a44ee2e11957642e461bc3ef0a67ee33f29ad7416914c17a5978d1aa2dd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe

Filesize
468KB

MD5
0f641bae84695780f4e70f3fafeb5c7e

SHA1
5b11df1c627eaf65ea9ac5d96b517fc977d3ccc7

SHA256
7b094933a3b6fd1df1abb8f147d5b4b1771a6e34c8372321078f17bb02813793

SHA512
225bae34cacdc55637f7405ab79c890eb3f1b39c1b135e2bd8201e6e5d58fb75a54fef6c67c63d3b478c4a36dd1283236f849d4d61b70ae496d39e06e8fd7710

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe

Filesize
468KB

MD5
599d27c1dd979097ceeb2017ae798c3b

SHA1
14a2d4343f5d4ec43429b302edc4194a2cc459ec

SHA256
4e62767fb7e28091d6a419a774486afb6f86638916ea94d1975c945ec99fa04e

SHA512
060274a670d8f2948bdd73b6ba712f61bba27dd12acc6ca79f44a01d63e835391d8e83d45d7ca1a3715117b9e426fdecc076098a5084051d888b5130787532bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe

Filesize
468KB

MD5
fbd49e0ce9f1b19b55d9566757d800cd

SHA1
9f79c0ed573ec7fc7710757c7da084cd41be221f

SHA256
3f32b7d7c27fecb7b76b9cd4ca9a4ddd07296b67dc0fc2ca2f1b81f21f7dd933

SHA512
b385d85c0422e489e61c7e5ec74831f464d3239154e203336864acdeb4c58a648fc0e99e8854a946651a3ee7b7b02c0d075c92758e936a88acca71a0560adbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe

Filesize
468KB

MD5
2c4b5d09f0a30f389f53ab130c7498fe

SHA1
8b54959738e9a560d123cf8c63fffc078a875631

SHA256
0ac0095a4e3f86b2388e8850dd977b7ba67b60289ef3ce0c029497771440caa2

SHA512
6d651430f20075fc382b7ea70a8588310badf46e2992cad34be79d3496e7d9540df4fceaae3ec732acd78794272d2f5fb68e87df530b7ee4e931c46e29b99ae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe

Filesize
468KB

MD5
89d0650edd1ecd99f9876a487e30e916

SHA1
4969990df592dcd13ffb2200f71c98c10e43656e

SHA256
4065cbecd06544fc2acd6b1e8c712b1d89136eaec39a814ada40b9ecf685d066

SHA512
74643bca35f56565d15c80a5c3665cefe44c936fc8b0c6333660cd5a9439ebd098fa56e5399d6acd66e33588bd547eac58150ef39ca2736fece951b35314d5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe

Filesize
468KB

MD5
e55ea033c0983480e2f333c848358cca

SHA1
8ed80a921f69ff43ab087729a1225c4c62260e63

SHA256
78cf1205e3c3c842fa5b3fd46a1e62a8949d89f65e15755276704e1650b18acb

SHA512
0e1b24ca896871ed3ce9726405bccde23684f1ee8315bcbd56cd84dd74dce9d6843dfd1d53a103d263d54f8637e73677e16fee117d5d003631fc05c321bedf33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe

Filesize
468KB

MD5
330cab2364380bdbfb948960e1e1b136

SHA1
99c3223b7b8cafb27919f452f4f10d0c0abcb35c

SHA256
a0f4ddfa4a6c05ef8c3a58181e6df3cfbfae80c3a820bb63a2fe780c89be6742

SHA512
be51d0ab860fed7bd015b6a02be3d06754f2e26e913aa8ecdf4c9259335697397ec86d26219f937b558be187bb397762a14857a4788ea3f8c8e3fddc5dcb7692

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe

Filesize
468KB

MD5
45320bb1f14b63ee0bb0b4391af0a95c

SHA1
54e3c740dddc424d413f781818968fa9478c5c7d

SHA256
3398c3f33b01a5010cc3f39cd6e8b91cdf691a8df6810ceb14fc64c5c0c74b45

SHA512
4e29e26c4116d7e917fd2d6b1e6ba99464ce6b5d02f5876957544f2c664c72ddb2917605084f4b29fd050980bd280fcf54bff89cc73a888834a802af94cf85d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe

Filesize
468KB

MD5
35318c96fc710e0eedd776d7d7c8b19a

SHA1
04e3e6e3ba8917a5f0da07aad97c4ee0ba70542e

SHA256
a49644e6016ca0c6e662ae0714ba4b75eb25fee5c9862f58c4686cc4dd3c2c51

SHA512
d7fb48d2924e084746e1f1f6d8fb1387c42492c02e15ab59231ed11b9e55acf6a09367e5d665c10ba9c18e2757047ebe452ace84e6191209fcbd509bee30eace

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe

Filesize
468KB

MD5
13928f7edce1dd8a0d16e310ffb8a658

SHA1
09245d64e382435286dc93fa1e278390b30b6d67

SHA256
42096b59f383ee645d0978ed1173edc5b2d60b40e7c848037775205b53287fdd

SHA512
e3965f94e125a0b04aeed822b15243daccf1287f918c982cc6bb754a436f7a4b58bb97de2eae1fb17f009c607f51fe591332ec75ded069bf925513c45e8c3cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe

Filesize
468KB

MD5
fa294f92e89b5cd9e857571a371f613d

SHA1
9c1f90742aa252870dd36a3be55af49bf57bc873

SHA256
1184187341ec2f09dfa13f0a8ba2b169ae1e31eee769b0455f98c231f36ca291

SHA512
9472c93c9a4ab4a5447424f0fc258d07c4e503b3b3874978b103dd7befddf6834f66eb66d61725a05b374c007757bd68d0bbb1acfdcc1027e3518ba123a4bbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe

Filesize
468KB

MD5
1fbef8cfb2cfa78ab3d6c4c7e48fb1de

SHA1
b5df8357660ef7a7eed7756383d05662a7c5b290

SHA256
bafeb5d330cf53adcbe1daf5494afe0c581de6ccf14cbcefadd6747414d1d7d4

SHA512
71b3f97d4fe526e31b81dce9fec2c887f988e226eb7e21c7f18394c687f2f42d6a617c1d457e1f8729290ccab3de955948d607cb428a6bd6b6d7066e1586171b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe

Filesize
468KB

MD5
40428dd045e4ff916a91d8acf336b379

SHA1
701225564a279d7800469869c3c4cc6af8c01163

SHA256
24cb92f76db565f98767f05fa25668fe06d8bfc202e49374f1abff0356c2f2ea

SHA512
b4472a25eb446512b49dfa0cbd0058ce05e6b6e81c9066903e9c877639a8e90e215d6800f0609694afe4d614b07163c8a890c1fa02b2069dcbc809c19d8cd7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe

Filesize
468KB

MD5
3625f757511e52fe04e883739d8d0f05

SHA1
cf62be7de9c2a7e6c16222bb5b115fea6953f6b8

SHA256
1820690eaa0179e8fa93165d12777b02d148f9cc3b633bd49889e22ea3dfe187

SHA512
2dd81e12320a2bdffb497d9f4f3c6e2bcdfa0a3299af0152bb1ba2d70ef8e6640683f68c3191ab0cc66bcb3c0a2314347a63d94a7d3dc9f20ef6da5e5791e54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe

Filesize
468KB

MD5
2bcc12fb83d07b63544aea1594c7c880

SHA1
09170e028a50b73919f1c26e324079a5e3a05fe1

SHA256
9ea5866326fbedbb9943a693213d92c05c0b7f47ea5875c14481c2d1923c9e06

SHA512
7741460206e43373b46b39588402a28da626d6c124665520aec319515dce916bbccca438d8121ab2f0903392c56cf5c9b2797e9b27a7f139baa86a095e4b5c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43887.exe

Filesize
468KB

MD5
1e7bc8227a3acb2ca409fbeaa41d0643

SHA1
98f00c676c3f0d987aa84ebfc81ca50a1e3df4c7

SHA256
28dbcfd3b0283e254bebe3c1285693f86912c462ae422b0b14c66b3e631cc386

SHA512
318b028a5e90b102653caecdfb0fbc45907a64b30d3856ec7c0cc8267309b26862f4202fb8c88ce4b0d93fa7974965e872cdc173939206697c2e57db654bee31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe

Filesize
468KB

MD5
782afb24fddfa49c90b02ffee1200006

SHA1
94a0a6fb94066a08344019d144aae64f1af39e13

SHA256
07232d1ab6e8937552e77ea7770c219969650488b6576c5de3f43348aa4db743

SHA512
8a8229894b1c63c6e1d804c354970afd381f11f3f002058d5faa39340a30852d80fda2cf13fff8625e5ad3763718d935e68d0c215c1292c4543b65d372922dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe

Filesize
468KB

MD5
2497c708b4fc53cb1ca4ba97865f58be

SHA1
2db50df4f428879cd7158c263cf661338e317417

SHA256
b46edfaaccc36299edefdc1cb015b882f0d34458c8b65d41dd8962a95aa110c0

SHA512
31e99024297a6a50e98b286e01cf94d8ce4a4d021aecdcd73e75cbb66e00b1f0c42bcb163aff9084fb0a7241efecbad67eb8c4e7ea9512d6a1e470caf253cb67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe

Filesize
468KB

MD5
62cd789a4c691747ff23ddac8fe3d360

SHA1
b7f5da32e98a55e96ca032e2646cc4ca8284f1c0

SHA256
97cf5f22d65a3679698769e976ba29181b7eec4dff030832adabf9f5abe5baa0

SHA512
3b40be3310753a5765461556348709ce40816cb3e581ff3ed6d2e93873d9fa607dff42541ec1baa9fe37d90519841736632ca23e6c5a5163fb5c11cbac5b7d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe

Filesize
468KB

MD5
3a711266a85e3c933c1369bec636912f

SHA1
42fc20d2a4db61a668f6146bb27ff32316082568

SHA256
723a31604c4a425d7e3d5c28b389569a768584b992b79721b519d3e9f8ce4517

SHA512
8261f7ba2d2d8f22ff6bf8b5d6dc5a749e672d3c33789181e084b35a85526b0b223f9bea4bc1ba5e8b3f43345a88a0b4fbf6c80139fc6de160831c1f6b57691a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe

Filesize
468KB

MD5
072c10e3e10bce2bcdf6ece251e4ae93

SHA1
3d8f6267055f270ed10ceeded56904d2b5a64d9c

SHA256
b1eb1d439526a5331562ada2a1395bf433381b5994b0af7d429448db810e358d

SHA512
97d697e7616178ae1a7a0621a7a0e6902781bc331c5553acd2f5910c1768a5adc21308bc2438992a508f09c35c0165eb0dd658d62cb6b34453483014a635a366

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe

Filesize
468KB

MD5
c8d044690e3cc8216b31af09ebc55508

SHA1
8d12fc0c686b7b24e25bddc73f16ae8d40d0cd17

SHA256
7cd11e55b953a0c4352f84984be42028823eccdd653b4668af1a0f2f1185dcda

SHA512
a18510aac3949fa19b7ad94ff6078e5786735abc3db4f0a73837c19e5c2c63dc1224ce82c89d6474cb07fbe45a2e6cdb89b3c44ece1d1413a80705eed0cf39ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe

Filesize
468KB

MD5
01f1d1de9130dea6eb628de1c07f46ed

SHA1
dfae76a2343a6c4d151d6d4ee0fce513cb29d4e0

SHA256
b470e3a03abaf082a01579b535c4f3d3b2755656cb80ce404ccc61a44b69935d

SHA512
39b7f6a61cf6f73926e05dedccf61381d5bf47a9eeb4dad66c41d218487ecbf6776cd43b52111a766becc32fb847961be3ddb40e5e1a549677d7c8b676ea150f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe

Filesize
468KB

MD5
922151a4dc5c0540f5aab91cc5d33b57

SHA1
7a488a9fbde69a2e951ad162d04d2b8c9042cab8

SHA256
6d71f7046e1a1fe6e16822276883722425a388897a4f45098dc33e4ac85f7aeb

SHA512
c6ca5a2b51342a53fc754159614d1bdccaad9f4a468807351c92a4cb0bd8033e53053f2aaa7ee210b98eeda09a1e8bd7190a7316a3c4ca59f9ad3375d185b0c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe

Filesize
468KB

MD5
972c5bb957aa5b8b81b595470cfea149

SHA1
48ff136f47fbefb25f47d2c09a373f9c4eda0551

SHA256
512d4e87d43e14ac3bc44a373fad50d61cd0640704ebf8b7831a36b45cf38fc3

SHA512
397046cb46ef40c6cea1829665317fd31a3343808455c98def8820ea4bd65a82d2aa74ec5635cd9b5ede216143867ccdbb187cdbd0df86287e3954e81426ed50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe

Filesize
468KB

MD5
e43ca286960811e72e8b778e1bacf0c8

SHA1
ca14b82575b4845addf846c33c47746b9b17e22a

SHA256
e94ad3c36dabbf082cdd9acfa93d38377f5abb6b34a086f2ef03c10d01fd4eb8

SHA512
1a96901b7fad8b8bff8ea795715cbe19d4ed5a666ed7e5cc9b7274b8cad490a5ea14e1cc661e4708ec900694ebfe78ab2123a8795dab493698e78aa65b3f8d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe

Filesize
468KB

MD5
42fca6e75428d05b508cf0beb5aee489

SHA1
34791cbff00277b13b11d29de34ff7eaf3828218

SHA256
04d4e03d2fd32dfc876ec586cce517143c0f9d8ff323f575ca7735ca90a5b4f0

SHA512
ec9ee9cbbaec61bb4cacf9d5a7eacf5e81476fc7013b1aa553b12a94bb7d9f84a75a2f296ec30b979759708123a1c1c90f43d30fd75754c4b20c85c1c4a9c015

Download Submit