94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362

Analysis

max time kernel
135s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe
Size

468KB
MD5

1fc5f91197b421ee9405907565a73e4a
SHA1

42430bc457134cf25b0eed832fae0ff6519c926b
SHA256

94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362
SHA512

f1cec0038a21a434484260b931cf79f9f2d8d71b4d8b358cdfade0cc26722178feb38edaa74fe114f2052d002d3fffed27767ace297626338b9512e3b630640f
SSDEEP

3072:1bB2ogIdFn5UtbYJHzcjcf8/EChCy7/CnLH0xVPKEC92CxkueVey:1bcod5UtOH4jcfCjNmECMqkue

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2476	Unicorn-46046.exe
3624	Unicorn-17249.exe
4048	Unicorn-14404.exe
4224	Unicorn-62366.exe
836	Unicorn-60046.exe
1244	Unicorn-27312.exe
3204	Unicorn-59884.exe
4752	Unicorn-41197.exe
5028	Unicorn-53838.exe
4336	Unicorn-29869.exe
5052	Unicorn-32452.exe
4484	Unicorn-52318.exe
1824	Unicorn-3293.exe
3528	Unicorn-3558.exe
4540	Unicorn-62965.exe
1704	Unicorn-61927.exe
2600	Unicorn-29892.exe
3132	Unicorn-62887.exe
2596	Unicorn-21754.exe
4980	Unicorn-55207.exe
3252	Unicorn-4371.exe
2880	Unicorn-24237.exe
2416	Unicorn-44574.exe
3120	Unicorn-9571.exe
4736	Unicorn-38444.exe
4788	Unicorn-55243.exe
1092	Unicorn-57319.exe
4028	Unicorn-36219.exe
5100	Unicorn-58279.exe
4012	Unicorn-25284.exe
4176	Unicorn-36629.exe
764	Unicorn-46622.exe
1168	Unicorn-58251.exe
3428	Unicorn-38942.exe
4944	Unicorn-51687.exe
2392	Unicorn-51687.exe
2420	Unicorn-33387.exe
1892	Unicorn-63316.exe
4304	Unicorn-17379.exe
1016	Unicorn-53223.exe
4460	Unicorn-64292.exe
840	Unicorn-11396.exe
3156	Unicorn-58738.exe
4500	Unicorn-58708.exe
2916	Unicorn-39399.exe
5032	Unicorn-25118.exe
2376	Unicorn-17997.exe
1608	Unicorn-49492.exe
3096	Unicorn-36341.exe
4404	Unicorn-25694.exe
3348	Unicorn-28190.exe
1936	Unicorn-59684.exe
1360	Unicorn-59684.exe
3744	Unicorn-20510.exe
3552	Unicorn-25284.exe
3556	Unicorn-64173.exe
4892	Unicorn-44308.exe
1676	Unicorn-63908.exe
4232	Unicorn-26538.exe
4392	Unicorn-14349.exe
2820	Unicorn-45874.exe
4768	Unicorn-13548.exe
3712	Unicorn-33886.exe
5076	Unicorn-33886.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4020	3704	WerFault.exe	157
6108	4644	WerFault.exe	156
6212	1892	WerFault.exe	126
6548	3704	WerFault.exe	157
844	4648	WerFault.exe	181
13188	8880	WerFault.exe	463
14104	15624	WerFault.exe	759
16608	15972	WerFault.exe	814
3660	4468	Process not Found	898
8320	18004	Process not Found	944

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25258.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16632	dwm.exe
Token: SeChangeNotifyPrivilege	16632	dwm.exe
Token: 33	16632	dwm.exe
Token: SeIncBasePriorityPrivilege	16632	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe
2476	Unicorn-46046.exe
3624	Unicorn-17249.exe
4048	Unicorn-14404.exe
4224	Unicorn-62366.exe
836	Unicorn-60046.exe
1244	Unicorn-27312.exe
3204	Unicorn-59884.exe
4752	Unicorn-41197.exe
5028	Unicorn-53838.exe
4484	Unicorn-52318.exe
5052	Unicorn-32452.exe
4336	Unicorn-29869.exe
3528	Unicorn-3558.exe
4540	Unicorn-62965.exe
1824	Unicorn-3293.exe
1704	Unicorn-61927.exe
3132	Unicorn-62887.exe
2600	Unicorn-29892.exe
2596	Unicorn-21754.exe
4980	Unicorn-55207.exe
2880	Unicorn-24237.exe
3252	Unicorn-4371.exe
3120	Unicorn-9571.exe
4788	Unicorn-55243.exe
2416	Unicorn-44574.exe
4012	Unicorn-25284.exe
1092	Unicorn-57319.exe
4176	Unicorn-36629.exe
4736	Unicorn-38444.exe
4028	Unicorn-36219.exe
5100	Unicorn-58279.exe
764	Unicorn-46622.exe
1168	Unicorn-58251.exe
3428	Unicorn-38942.exe
4944	Unicorn-51687.exe
2392	Unicorn-51687.exe
2420	Unicorn-33387.exe
1892	Unicorn-63316.exe
4304	Unicorn-17379.exe
1016	Unicorn-53223.exe
4460	Unicorn-64292.exe
840	Unicorn-11396.exe
3156	Unicorn-58738.exe
4500	Unicorn-58708.exe
2916	Unicorn-39399.exe
5032	Unicorn-25118.exe
2376	Unicorn-17997.exe
3096	Unicorn-36341.exe
1608	Unicorn-49492.exe
4404	Unicorn-25694.exe
3348	Unicorn-28190.exe
1360	Unicorn-59684.exe
1936	Unicorn-59684.exe
3744	Unicorn-20510.exe
3552	Unicorn-25284.exe
3556	Unicorn-64173.exe
4892	Unicorn-44308.exe
4392	Unicorn-14349.exe
1676	Unicorn-63908.exe
2820	Unicorn-45874.exe
4232	Unicorn-26538.exe
4768	Unicorn-13548.exe
5076	Unicorn-33886.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2476	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	82
PID 3168 wrote to memory of 2476	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	82
PID 3168 wrote to memory of 2476	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	82
PID 2476 wrote to memory of 3624	2476	Unicorn-46046.exe	83
PID 2476 wrote to memory of 3624	2476	Unicorn-46046.exe	83
PID 2476 wrote to memory of 3624	2476	Unicorn-46046.exe	83
PID 3168 wrote to memory of 4048	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	84
PID 3168 wrote to memory of 4048	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	84
PID 3168 wrote to memory of 4048	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	84
PID 3624 wrote to memory of 4224	3624	Unicorn-17249.exe	85
PID 3624 wrote to memory of 4224	3624	Unicorn-17249.exe	85
PID 3624 wrote to memory of 4224	3624	Unicorn-17249.exe	85
PID 2476 wrote to memory of 836	2476	Unicorn-46046.exe	86
PID 2476 wrote to memory of 836	2476	Unicorn-46046.exe	86
PID 2476 wrote to memory of 836	2476	Unicorn-46046.exe	86
PID 4048 wrote to memory of 1244	4048	Unicorn-14404.exe	87
PID 4048 wrote to memory of 1244	4048	Unicorn-14404.exe	87
PID 4048 wrote to memory of 1244	4048	Unicorn-14404.exe	87
PID 3168 wrote to memory of 3204	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	88
PID 3168 wrote to memory of 3204	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	88
PID 3168 wrote to memory of 3204	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	88
PID 4224 wrote to memory of 4752	4224	Unicorn-62366.exe	93
PID 4224 wrote to memory of 4752	4224	Unicorn-62366.exe	93
PID 4224 wrote to memory of 4752	4224	Unicorn-62366.exe	93
PID 3624 wrote to memory of 5028	3624	Unicorn-17249.exe	94
PID 3624 wrote to memory of 5028	3624	Unicorn-17249.exe	94
PID 3624 wrote to memory of 5028	3624	Unicorn-17249.exe	94
PID 1244 wrote to memory of 4336	1244	Unicorn-27312.exe	95
PID 1244 wrote to memory of 4336	1244	Unicorn-27312.exe	95
PID 1244 wrote to memory of 4336	1244	Unicorn-27312.exe	95
PID 4048 wrote to memory of 5052	4048	Unicorn-14404.exe	96
PID 4048 wrote to memory of 5052	4048	Unicorn-14404.exe	96
PID 4048 wrote to memory of 5052	4048	Unicorn-14404.exe	96
PID 3204 wrote to memory of 4484	3204	Unicorn-59884.exe	97
PID 3204 wrote to memory of 4484	3204	Unicorn-59884.exe	97
PID 3204 wrote to memory of 4484	3204	Unicorn-59884.exe	97
PID 3168 wrote to memory of 1824	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	98
PID 3168 wrote to memory of 1824	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	98
PID 3168 wrote to memory of 1824	3168	94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe	98
PID 836 wrote to memory of 3528	836	Unicorn-60046.exe	99
PID 836 wrote to memory of 3528	836	Unicorn-60046.exe	99
PID 836 wrote to memory of 3528	836	Unicorn-60046.exe	99
PID 2476 wrote to memory of 4540	2476	Unicorn-46046.exe	100
PID 2476 wrote to memory of 4540	2476	Unicorn-46046.exe	100
PID 2476 wrote to memory of 4540	2476	Unicorn-46046.exe	100
PID 4752 wrote to memory of 1704	4752	Unicorn-41197.exe	102
PID 4752 wrote to memory of 1704	4752	Unicorn-41197.exe	102
PID 4752 wrote to memory of 1704	4752	Unicorn-41197.exe	102
PID 4224 wrote to memory of 2600	4224	Unicorn-62366.exe	103
PID 4224 wrote to memory of 2600	4224	Unicorn-62366.exe	103
PID 4224 wrote to memory of 2600	4224	Unicorn-62366.exe	103
PID 5028 wrote to memory of 3132	5028	Unicorn-53838.exe	104
PID 5028 wrote to memory of 3132	5028	Unicorn-53838.exe	104
PID 5028 wrote to memory of 3132	5028	Unicorn-53838.exe	104
PID 3624 wrote to memory of 2596	3624	Unicorn-17249.exe	105
PID 3624 wrote to memory of 2596	3624	Unicorn-17249.exe	105
PID 3624 wrote to memory of 2596	3624	Unicorn-17249.exe	105
PID 4484 wrote to memory of 4980	4484	Unicorn-52318.exe	106
PID 4484 wrote to memory of 4980	4484	Unicorn-52318.exe	106
PID 4484 wrote to memory of 4980	4484	Unicorn-52318.exe	106
PID 3204 wrote to memory of 3252	3204	Unicorn-59884.exe	107
PID 3204 wrote to memory of 3252	3204	Unicorn-59884.exe	107
PID 3204 wrote to memory of 3252	3204	Unicorn-59884.exe	107
PID 5052 wrote to memory of 2880	5052	Unicorn-32452.exe	108

C:\Users\Admin\AppData\Local\Temp\94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe
"C:\Users\Admin\AppData\Local\Temp\94dad7f8ec0b020d9b7d2dd68e4f5016d112b404e8bb0e86bd567d4ffe9eb362.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61927.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46622.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        10⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        11⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        10⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        10⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
        9⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        10⤵
        
        PID:19544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        9⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        9⤵
        
        PID:19700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        9⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        9⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        9⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        8⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        7⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        9⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        9⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        9⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11088.exe
        8⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        9⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
        9⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        8⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        8⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        9⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        9⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exe
        9⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        8⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        7⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        7⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        9⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4572.exe
        10⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        10⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        9⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        9⤵
        
        PID:15972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15972 -s 72
        10⤵
        Program crash
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        9⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        9⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        8⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
        9⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        9⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        9⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        8⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        8⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        7⤵
        
        PID:18968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        10⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        10⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        9⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38845.exe
        9⤵
        
        PID:19424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15207.exe
        8⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        8⤵
        
        PID:17844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        9⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
        9⤵
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19075.exe
        8⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
        8⤵
        
        PID:18892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        7⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        6⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29892.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        10⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        11⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        10⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        10⤵
        
        PID:18212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        9⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
        9⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        9⤵
        
        PID:18412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        9⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        9⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        9⤵
        
        PID:19100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40219.exe
        8⤵
        
        PID:18016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        9⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        9⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        8⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        8⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        7⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        7⤵
        
        PID:18340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        6⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        9⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        9⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        7⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:19356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        8⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        8⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        7⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        7⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        9⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        9⤵
        
        PID:18976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        8⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        7⤵
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
        7⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        7⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39698.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        5⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        8⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        8⤵
        
        PID:18440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        6⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13451.exe
        7⤵
        
        PID:19000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47463.exe
        6⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        7⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        7⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25706.exe
        5⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        5⤵
        
        PID:17748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        8⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62148.exe
        7⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        6⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22538.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        9⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        9⤵
        
        PID:19960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        8⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        8⤵
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        7⤵
        
        PID:19228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        6⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 632
        7⤵
        Program crash
        
        PID:6108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 740
        6⤵
        Program crash
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        5⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        8⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        8⤵
        
        PID:19376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        6⤵
        
        PID:19016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16929.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        6⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        5⤵
        
        PID:18404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53448.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        9⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        8⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        7⤵
        
        PID:19668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25847.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        6⤵
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49739.exe
        6⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        5⤵
        
        PID:18320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
        5⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28519.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        8⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
        7⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        7⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15245.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4546.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        5⤵
        
        PID:17732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
      4⤵
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28519.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        7⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2211.exe
        7⤵
        
        PID:19500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        6⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        6⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        5⤵
        
        PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
      4⤵
      PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6563.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        5⤵
        
        PID:17320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        5⤵
        
        PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        5⤵
        
        PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35149.exe
      4⤵
      PID:112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60046.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
        7⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        9⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47895.exe
        10⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        10⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        10⤵
        
        PID:17488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        9⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        9⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        9⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
        10⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
        9⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        8⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        9⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        9⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        7⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11511.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        7⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        8⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        8⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        8⤵
        
        PID:18632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9597.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        7⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        7⤵
        
        PID:19724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49492.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        8⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        8⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22090.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        7⤵
        
        PID:19680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16631.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        5⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        6⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
        7⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32661.exe
        6⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        6⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        6⤵
        
        PID:18376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        5⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        8⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7485.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        7⤵
        
        PID:18596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        6⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        6⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        5⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52896.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        6⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        6⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16871.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        7⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        7⤵
        
        PID:19764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        6⤵
        
        PID:17772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14023.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        6⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        5⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        5⤵
        
        PID:19072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48100.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        5⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        6⤵
        
        PID:19708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        5⤵
        
        PID:19172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43107.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
      4⤵
      PID:1224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        8⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
        7⤵
        
        PID:17936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        6⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        6⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        7⤵
        
        PID:16920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        6⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        5⤵
        
        PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        6⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        5⤵
        
        PID:13404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        5⤵
        
        PID:18232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exe
      4⤵
      PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44555.exe
        5⤵
        
        PID:16892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
      4⤵
      PID:11112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      4⤵
      PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        5⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        6⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29120.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        7⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        6⤵
        
        PID:17716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        6⤵
        
        PID:18984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        5⤵
        
        PID:19688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        6⤵
        
        PID:17312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        6⤵
        
        PID:19776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        5⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        5⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
        5⤵
        
        PID:19492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      4⤵
      PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
      4⤵
      PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
      4⤵
      PID:17864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        6⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        5⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51598.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        5⤵
        
        PID:18112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
      4⤵
      PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
      4⤵
      PID:18176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
      4⤵
      PID:12156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
      4⤵
      PID:19236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
    3⤵
    PID:8548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
    3⤵
    PID:12316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57034.exe
    3⤵
    PID:16908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        9⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        9⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52440.exe
        9⤵
        
        PID:17888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        8⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        8⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        8⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50004.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        9⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2211.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        8⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
        7⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57048.exe
        7⤵
        
        PID:18100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48687.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        7⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        6⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
        7⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        6⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        6⤵
        
        PID:19920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        6⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 720
        7⤵
        Program crash
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        6⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        7⤵
        
        PID:19712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        6⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        7⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
        7⤵
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        6⤵
        
        PID:18956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        5⤵
        
        PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        6⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2713.exe
        8⤵
        
        PID:17664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        7⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        7⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        7⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        6⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        8⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        8⤵
        
        PID:19604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        7⤵
        
        PID:19932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        6⤵
        
        PID:17956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
        5⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        6⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8880 -s 548
        7⤵
        Program crash
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        6⤵
        
        PID:19472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
        5⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
        6⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        5⤵
        
        PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        5⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56417.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
        7⤵
        
        PID:17884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        6⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        7⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43040.exe
        7⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        5⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        6⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        7⤵
        
        PID:19572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        6⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
        5⤵
        
        PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        6⤵
        
        PID:19156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        5⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        5⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        6⤵
        
        PID:19084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45403.exe
        5⤵
        
        PID:17680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
      4⤵
      PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
      4⤵
      PID:16060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24237.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        5⤵
        
        PID:3704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 404
        6⤵
        Program crash
        
        PID:4020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 408
        6⤵
        Program crash
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        5⤵
        
        PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
        5⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        8⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        8⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        8⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27587.exe
        7⤵
        
        PID:18616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        5⤵
        
        PID:18336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45426.exe
      4⤵
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        7⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        6⤵
        
        PID:17996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15207.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        5⤵
        
        PID:19188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        5⤵
        
        PID:17640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7002.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exe
      4⤵
      PID:17636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
        7⤵
        
        PID:17920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        6⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        7⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        6⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe
        6⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        7⤵
        
        PID:15624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15624 -s 464
        8⤵
        Program crash
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        6⤵
        
        PID:19116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        5⤵
        
        PID:19640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        5⤵
        
        PID:18160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        5⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        5⤵
        
        PID:19064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
      4⤵
      PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15482.exe
      4⤵
      PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
      4⤵
      PID:18912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16871.exe
      4⤵
      PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        6⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        6⤵
        
        PID:18664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
      4⤵
      PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        5⤵
        
        PID:20104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
      4⤵
      PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
      4⤵
      PID:19592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
      4⤵
      PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
      4⤵
      PID:1720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
    3⤵
    PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
      4⤵
      PID:16580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36304.exe
    3⤵
    PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
    3⤵
    PID:17436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        6⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
        9⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        8⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        8⤵
        
        PID:18652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        7⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        7⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        9⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
        9⤵
        
        PID:18624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        8⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        8⤵
        
        PID:19144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        7⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        7⤵
        
        PID:18936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42958.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        6⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        5⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        7⤵
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        6⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        6⤵
        
        PID:19772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        7⤵
        
        PID:18604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18660.exe
        6⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        7⤵
        
        PID:17900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        6⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        7⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
        7⤵
        
        PID:19752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        6⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61451.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6563.exe
        6⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        7⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        5⤵
        
        PID:19032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54642.exe
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5027.exe
        6⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        7⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49199.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        5⤵
        
        PID:18896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50081.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34276.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        5⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6320.exe
        5⤵
        
        PID:17836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27450.exe
      4⤵
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
      4⤵
      PID:17672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        5⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        8⤵
        
        PID:17980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        7⤵
        
        PID:19744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        6⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        6⤵
        
        PID:19328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:18368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
      4⤵
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35748.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        7⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        7⤵
        
        PID:19364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
        5⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        6⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        5⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55495.exe
        5⤵
        
        PID:15084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
      4⤵
      PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
      4⤵
      PID:19180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
        6⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        6⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35826.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        5⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3389.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        6⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
      4⤵
      PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
      4⤵
      PID:16984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
    3⤵
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        5⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31575.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
      4⤵
      PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
      4⤵
      PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
      4⤵
      PID:17624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47487.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
      4⤵
      PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
      4⤵
      PID:17352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
    3⤵
    PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
      4⤵
      PID:14028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
    3⤵
    PID:13804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23826.exe
    3⤵
    PID:2104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        7⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        6⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        6⤵
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        6⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        5⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
        5⤵
        
        PID:19052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        5⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        6⤵
        
        PID:19132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
      4⤵
      PID:15152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
      4⤵
      PID:17780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44308.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        6⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        6⤵
        
        PID:18480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        5⤵
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        5⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        5⤵
        
        PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
      4⤵
      PID:12516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
      4⤵
      PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43690.exe
      4⤵
      PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        5⤵
        
        PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
      4⤵
      PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
      4⤵
      PID:17852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
    3⤵
    PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
      4⤵
      PID:18004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
    3⤵
    PID:12784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
    3⤵
    PID:17468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36219.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36219.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
    3⤵
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
      4⤵
      PID:14064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe
      4⤵
      PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
    3⤵
    PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
      4⤵
      PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
      4⤵
      PID:19396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
    3⤵
    PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14094.exe
      4⤵
      PID:1036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
    3⤵
    PID:12940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
    3⤵
    PID:17104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16871.exe
    3⤵
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        5⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50120.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      4⤵
      PID:18156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
      4⤵
      PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
      4⤵
      PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
      4⤵
      PID:17872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41765.exe
    3⤵
    PID:10572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24148.exe
    3⤵
    PID:15868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
    3⤵
    PID:17620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
  2⤵
  PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18660.exe
    3⤵
    PID:12768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
    3⤵
    PID:4828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
  2⤵
  PID:8864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31323.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31323.exe
  2⤵
  PID:13228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
  2⤵
  PID:17828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 3704
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4644 -ip 4644
1⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1892 -ip 1892
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3704 -ip 3704
1⤵
PID:6332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4648 -ip 4648
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8880 -ip 8880
1⤵
PID:12628

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe

Filesize
468KB

MD5
758164ab31ccb58fccb2e439fe40eceb

SHA1
a2923a9304ae1d84c6bad6867ed3c2f0aa9b1e83

SHA256
547b915990519884db3ff5b65a928bcade0f1b9737283f81c55f1a0d266494ee

SHA512
8b29c63f80cc464f87d9573296b1f797361430199a8d4ccff09b9234af68b40e81121c2446123073467abfaf2a1a9736acde229e08ebcb7d23cf4e317ce3ca21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe

Filesize
468KB

MD5
b497d73aa36f61144a763628a9820771

SHA1
d219a066bf1c6e69757a3f052198ed060325f579

SHA256
1ee3f691c1b52858f5f5e2e4904c65ce82e3cfd36498dd28bc61c234f110c4f0

SHA512
066fb729f0c4c12e7a3ca73c223207c762012c6dcc2b149593e8c07b48ab5ffe93ddb7dd65a3e1592e65431213dfdbf8b1f36f026f5c12eec32b290062767082

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe

Filesize
468KB

MD5
0cc69d5b9c7c00f329340042161b2bb3

SHA1
93df7aff971b40aa09d0d44467391a9eae28a092

SHA256
5a67d21af8015619bfd83bb8b915af8c764fcc4e2a055d6ae314ce27999b313c

SHA512
b52e739fe6d8bbaa73c2f1ae580e974b41c3097a16bd122e8b4cd36396d916c914374da1e68c0920466ce6b666e5c5405fe0d3ce61f8e74ba9ce610d5ff6216e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe

Filesize
468KB

MD5
e264a485ef17b5a279781b6808aa4520

SHA1
9ae017e9280eb88b931b52bb7ddf70f377d329ad

SHA256
d0bf89e18d207a178a2969d7537c568f627b6a632ae6f4491531bd99036ddf2f

SHA512
bc78cd0a750765c602fc295cc4e2375f3654bba9510162ba9dd491bacfafb8099323642b4acbc60942cfcddda10a5dd73933e563b2051fd31670b0477a072420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe

Filesize
468KB

MD5
a01ce43768678c1466be7e72625c3fe1

SHA1
0df34f10cbd9008e106ab78972c9cf5499f41035

SHA256
09c9de670ed4b4be496e5f699abdb2d2d7e3c031b1477787d92505d97e505c0e

SHA512
4be6a96413fb675e059acbac7f310bb9a55699101df86d1065c3817b37e4b74dd441faeee36335e1d7675ca203e3ad15c93d50d3ac35042d60c58cd3c76e33ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24237.exe

Filesize
468KB

MD5
334c4da1f159a97ce451ed0573c09754

SHA1
da756d86acc41cd846949d27036e562f942f0b8d

SHA256
bb40095af018a4e5c317cd15e7d8949bd204d074d4a431607e27c02098135437

SHA512
35ba5c20352d4a4ffa59e37b53c154f671a319908a7bb87b7cbd92390214762d61e7936c726c08346549115515c11171c50ffd8b35707e53fa34ecb3f69e45b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe

Filesize
468KB

MD5
69f92910ae09f9727cdfe74475fc1540

SHA1
400bb07aa9ea651c3671ad8ef01ec802dca049d8

SHA256
a971b41d94fb96cf345d94563804ce430657440cfe8c16a1191cfbee6b0c33bd

SHA512
883f95cee294cb3781a1f773e7d445f6a9ae099189bda37b0a5f4cbc5ae6412f2fe954b1b5cbc31447f2ae6e903fd68ef0f540607ac02306a879e5bdd49215c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe

Filesize
468KB

MD5
6ebab123e282db402879f76f5cdc987b

SHA1
e40e76b6e0a40a1796b42bed2d01b9e9e046f32b

SHA256
3811594847282224164d8a1c3c94c16b883702eb814450bc4db9815fe928cd46

SHA512
6c9ff511caf7a164d137b1d0cf3d6fedb26ca3662f395e07004e3c806501f136147598c3177c93939c63df4ab64e8951b373937a8ccc052ebe7b4b08d013a9bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe

Filesize
468KB

MD5
8cd3aa10050da12b808583c0d837bee9

SHA1
da480bd54ccd8089c6e9c9f60adf76841cad6580

SHA256
b671c67f1c7e765e6515bdc53f718b3b027d6aa78f70cf5464c6da970c8dd03e

SHA512
499cae1d69ee6a1ac9b0cfb5cfa81eefe553d124210e93f25c83253cb2836b0653751785baac0724b378ae58024c5e1b817d807c24a3337cb5eaee3424b52e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe

Filesize
468KB

MD5
62bab1126fc23f5dbaccedefdc48429e

SHA1
dfece71667e3832681e3e79465875713b5d8f54e

SHA256
d3d44fc730359d48fb93b07e5a5758bf71733bb2c6ccc236f9bbac3287872525

SHA512
923d204c7371329f836906a2c2f3ee1bb7af833dfa5aad1cd5d3d10afe2c9e571a11e86ea863cb658bfcc011687b5f3d0d89b161cdc8d490de6e30ce7f6141f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29892.exe

Filesize
468KB

MD5
b3c082944320689b5d3d8c2074dc3928

SHA1
f25e2e6acc596af6e3fafde0a03d8bdd7f2b17c5

SHA256
d8035d85e4d119b25fbaab132b410dec301512dd63c193311e15a9a3b6370b15

SHA512
bcb2c59794ca1e3e8ad1b6057a44e67183e516336436b9c9af2b60aa8628a52c86f4df891bcae6c3f257be48dfd29b2de83009926a08cc239f9f011ec7dc85a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe

Filesize
468KB

MD5
054b37645a017587684ff00923c3114b

SHA1
83e35e6979a728a458c38ddede09234636aec633

SHA256
5f3bb7679dcb33d8636952a0558de5de45dcc8642145700387f9bba4b5dad3d1

SHA512
d2a8bf07855f577f1f126ccc7b2e6e19adef46f9fda7063c2675e759be0e9938542cbc8ba28481d9349213c84daea1658c56ca624db0c03ffa8d32b83dc94802

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe

Filesize
468KB

MD5
a37c67c3666dcecc1300df866a219bb0

SHA1
7fbfe290eb47dd1bbe3a6a5d7e03ce81a403bac5

SHA256
f901556a009ff23e31e45c92bf743d88d390642c32a8fb6e380f1606daa06410

SHA512
b44507d7d56e9124fa7f7416de7901ddb2d15781624fcb21b88d8ae0bfb9e66295919d7c80332b79a67cb6078b3dc2f7d171c7453e316034ee7517980c0384e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe

Filesize
468KB

MD5
7ca4302cd3a677ed6688098af906a5b1

SHA1
c33414c979529c437f1c4081693c28acbeb4b090

SHA256
d4c4dff4c0beb7d8592fa39d3c994bb40da6b8bb056a792fc3696535ede17e00

SHA512
0a3d6750b0187149a1cf6cc202e612201e33446b80113387defd42a7f156782b9bb70821947424538474edddddb824f26cbc486a3cbc5a470eba4f37c87064cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36219.exe

Filesize
468KB

MD5
80d2c5f832a4610eaa42340eb34cc85b

SHA1
a6884d6d6c58a496f68317e91c3348945b21173f

SHA256
c65797b3f93863c1bd91006182aa74904efb154f4cc1b676c70a8b57d75c4d47

SHA512
3ea4185fed9908a33146c283bb9438ca33dc95ce531c3e2434fb38cb4d82db7373cfdd3941b577edd4add6b02f77f84540da34f35229e7807cbf17695e93004b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe

Filesize
468KB

MD5
12ef54279257cffc00d6187453f1f94d

SHA1
e7d29e71ff5ef54dd88fb101e2134f53d706f20c

SHA256
1bf4125f7fb5257f0fb173151c53e5cc2aeee193a33d3241b51cd9b655217c7b

SHA512
4acaa4bb789587945b280fcddc6ccea8a520a4830b6f37377fb1dc3a9251405ab571dd9b6c227cc17d2b8d6abc7562001056c9c23e72a7c1e417739793dabbb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe

Filesize
468KB

MD5
2ea2c3f5ca73292b77939effe8c71c6e

SHA1
b716b5e60ce45fcaee59986f89766d035661a6ec

SHA256
5ffa378c9cbbb946904a0eb84e217b691ef02ea6422b1f323cf9d6d0e78917a5

SHA512
9cf9933d2d0f18d941273783bdaced0ea8ec1e04d8ae8a2c7e6d4fb54c8e5773c1e24cf6f111e17817c476dca02bf4c53af950dabf83d4ff8a75869697e8c482

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe

Filesize
468KB

MD5
906294f4b3d23995fa00fdd2c1ed4d9f

SHA1
66f3a6f6ba9871ce6a8fe550261b2a9ae9914703

SHA256
782b03efed84b9b5dbeb74ae4b3425f537caafe6f19b71ac3cad01469758c29a

SHA512
83617acaf131a9c7e7947bf6325a8ee65beb55cd7497c5d305aa625dc38e93c1ff4990c48aedcacb884c92738a1aebc76d61f3d13b13630eb7bb5bf1c7a4969e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe

Filesize
468KB

MD5
7ed7b2af272650e5d09cac17fda8dd22

SHA1
28fc2fc393a4555a7a2f606727a315c1e41a9234

SHA256
c0e60358c6ab09ccbb249774a617caf0274f72960e68cb877cfc4a6db029d9a6

SHA512
04b6687c059732dffc59ac482491c35b2ffaa0aa79670624127a81da36c23b17459349d64a57540376f7630dc4718ce63a72a7bf36788bdfa2201cc57036a385

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe

Filesize
468KB

MD5
e68aac5a541fcea993724262f80b7330

SHA1
5fffeced02072e15dfa3ba511212584f4025a48c

SHA256
3561d1713bddb2cd0b0fbd176e26b62885d6f83d0b25ad474ceeecbd285e9cc4

SHA512
b7dd1d86eda1f0b5b0c1315ff7b66890c06df92624e7ab3d18fea8577c42c2c76d459479a5dfaeb1d65b9b78c77d5bbaa3631e0bcfcfd779c3f66ef9b82fbf0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe

Filesize
468KB

MD5
5679ea25415d0dbe2f38965eac62f2d8

SHA1
7d30dc14a0912041a27619e0461686a92c757b81

SHA256
a838aa21ee4bafe8174a1d793ca1823e66c2a022f3028746d1c486c415c39879

SHA512
8f0386d9c3c9d162d9d29361fd8790fb8a528dae6d40ffd95f0545407ec1306a83b55284ba2abf2c699b25f4f93bc72badf5a5f91d8a51af03336d4e4fbbe493

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46622.exe

Filesize
468KB

MD5
d58622a7a4939bef1cb3dfc2e2762348

SHA1
93726fa003d30fb7cbf35586ba453668dae5165f

SHA256
db38f07b0c758b7c85124fbf04a130cc879e21e4e70ffae44a93cceb0dd6647d

SHA512
67d119866dc5d38cd3c72493322c5f17bb7e4df2522f862fda270f16fef3dbaa11a9a13ad49fdcce53c904fd78e8b598b210334c7a2155e3f232a3a0f6d32fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe

Filesize
468KB

MD5
49cffab8e88ee1c6bc6e33852e195d14

SHA1
1b1d7c0b9ccb7923034e274f4ceaf71fbe93f48d

SHA256
65c6eb3fec41714e572f1e43a99beb3d29f63975197c2f415bccbde494975fec

SHA512
0d979db0a14444700a4ef76c9f06720f1a92df60e1421917109baaedc9f74aab300aff0477c2dc65a0a5e12342500926e050995278edf233dfd1165e57628ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe

Filesize
468KB

MD5
d8070e098f82e914f2e47dab25b8c445

SHA1
56d96a5373e921f7d1cce1c447a92326f9a76995

SHA256
554104bc93a4a710bea9b696c59dde95e8fd5fb26c3106ec952494720488a227

SHA512
84ef9d09047652475e62ce8f4f48f5cbe3a1251efd9a890f691ec0cbd19769aed31ae7a81fda990a76df2c38396997b9d01609608ff57479425b8724e8ab27ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe

Filesize
468KB

MD5
5650ce211f46ecf94ee9c118d3de5aa3

SHA1
42ca0aa32f2b85f637708fc7c6e227bbb7f393de

SHA256
c53c449e071873db7e68c490f6189b09ce886e99d655f95f9d3345be2320567b

SHA512
60818abe04d0a7cb6aef89cbc6ea7e8c20b2d13c8e77485e170bf117389f50abf0b91c154c81d0dbc1dcc89a97bf7937b02a1294a09064afb1690390cff48c07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe

Filesize
468KB

MD5
affa4f78d31da748cf2fe6c467c6b1b3

SHA1
8bac62890136e98fc49eb238e3f391c7884e963c

SHA256
be2deef1b1ed3b5c54582166bac3c457c37123ce37bf07cf50323f4aac8d6318

SHA512
ffc9454dfc90b2651d81d08240eb982962ccd00ef4a19a72576921d539569c6936769cf5518f2837f1ec6f29cf67f87fb7289999760169179cadc787308e03e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe

Filesize
468KB

MD5
91cdf3416287adcf0e8753e0cfd8bc32

SHA1
ff5f5634113d90aa0dcf0a73ca9b18276856bd69

SHA256
736ca78260c3415b8afde029466720dc051b3083f8e1e3877de49480a5defaf8

SHA512
c610452c5a69019cd1e80bd9493c2bf543448a965d31c0b097730a6cf1301d3f4cb5b35a5128530e15db61e2f5fa165a8feabe7897ddbac92ec830cc9f116360

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe

Filesize
468KB

MD5
c1056703bfbb2308d2deb2355d64c3fd

SHA1
1d158ab3299777fb468ed82528412dea5fd789a8

SHA256
fcd9875446122366414ef026d7221201b1e03a3f2a473ef288cdac29249d9001

SHA512
fd19021b189634e9f788f8ce6229c5e13024a5b2c8008d61a4bac56e5525613ef2c0a7bbe98ca099717c774ee401a46b136058a26e1fdd59eda8010377c7bc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe

Filesize
468KB

MD5
119e3cf4102e0e5cc29dc3bbc14f6d46

SHA1
9079728127a5e549a8ad02a6049c707769823ec2

SHA256
4300e42d79926f3cd52f2152aaec88b69c219283aaf4aaae9b80f20aab8c39ce

SHA512
070fbe97e1ebc019802879e1c501e3065814abc286c5ef488c3f10e743261fe3f039294805210a3540a58200d3477da040b12127d7aff498bf091d4432e85b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60046.exe

Filesize
468KB

MD5
4e67f0ad4efe3c9449b69d93169320a6

SHA1
a8222615c6c7bd1fddffdd29a194811dfecd4bbf

SHA256
2a17796610d12b37951b0df1eecd06cada0df9d14e5f4c035e7fd200f6a1b659

SHA512
314a5deabca6308a9a81cff483862d5e012c6fe02d70e254f8ad7fa9331689a641040293bfdaa3e1c09c6e777532119ac31d7cf60d4aaed23e765b148567c4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61927.exe

Filesize
468KB

MD5
b5039a2ee6f96455326177273218d4e8

SHA1
33440dbef15e3241d55d015e4cfeb82edc903532

SHA256
60469308a0e480396d46ffae032aaca9da1fd2a04985ef732b010627b2611ce3

SHA512
23ca0e37ae94ede8da57d4216dc20a07b0d596b39798f8be71f8306a66c84992cec18dba9b3ed5ffd10b5e8c7d8ea81198a8bd4456e110506ba1ab5b041d9ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe

Filesize
468KB

MD5
589c10662af76661be6479d28e09b10b

SHA1
101f81d8381bebba95d201b256b9fc1cfa53f052

SHA256
b54ceac0e4258c8316447975f795d1cea7ed056133b7d3378d93eb1f185afc54

SHA512
5a529f1f492efb794451588e86d50e2d4f74b790b81e7a6b2ea4232c1f1c117193e7a5d8e81349601fefc143d742845cde093e44d400dbc8cb45d33f17ece1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe

Filesize
468KB

MD5
547f59b05bac0104845661f6ad7e7ab2

SHA1
15302b7276fc072c7628eebd1f9ba6d9374c7fa6

SHA256
7430169f4f972e7be273b0421392c700f112f834a795cb2f358eab1c286a77c8

SHA512
d90a9d73cb4eceec8c4239db01f77f348af8874777d04d7e3ea39fd376846e46b4154d9fc9e7f3f4bac9b6f2f03851ae21144607c8102b38a94118577d8e1151

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe

Filesize
468KB

MD5
d8392782965152765a08711675f7f8b2

SHA1
288b280cccf4620cd8a5e16cc58fbad90e7d4ee4

SHA256
76376f88be849076f2f0a2036f7696d5ca10a638c133f2623161895f6696963a

SHA512
ba363313ec7b35d683c7dfc05709c802db5e8bea3d6c673ab5d30f9a0e3894fb912c0eea1550d01abb0912493fc07df750c91490814bf272e17e008ab671eb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe

Filesize
468KB

MD5
0d4144f883594396c513cf9728cd886a

SHA1
758bf200967f45d4bec0b58bc452444ab4dff888

SHA256
09475ee1d8d43550bfce02d118057aac9d592b29635767ccdd9bd47d8e6881c2

SHA512
a97d4f00dd2b09454452da870bfb06905dde15b6dee939e882efcc1a823f73bc9095b841ca821a3825abcf06802478a00fc86cc18a2376a37a09ff81318067c2

Download Submit
memory/15624-2460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads