cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518

Analysis

max time kernel
118s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe
Size

468KB
MD5

4bf3ac563ee08cace40053ad8f9c0a10
SHA1

315dfa6f7287bfb634317d750605a9a8ebb832b7
SHA256

cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518
SHA512

fa6da9b952269f8fd8964ac6befe516e7a5b7284ca7aa418e38f99c05480343519e1634b7321b3d2c9c465c8eafc542b4edb497c4200414c120e97d302359456
SSDEEP

3072:96+Co3cOIV3KtbYoPzcXNfT/rChfPIpvn1HCOVLt40sB6CRNSjlx:96ToC9KtrP4XNfq08A4049RNS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4628	Unicorn-64197.exe
332	Unicorn-13024.exe
3848	Unicorn-46444.exe
3376	Unicorn-41333.exe
3592	Unicorn-62116.exe
3832	Unicorn-55431.exe
2236	Unicorn-61561.exe
4712	Unicorn-41992.exe
2084	Unicorn-43061.exe
2560	Unicorn-42796.exe
2144	Unicorn-23793.exe
3472	Unicorn-58695.exe
1604	Unicorn-12287.exe
4076	Unicorn-32153.exe
2584	Unicorn-16038.exe
4100	Unicorn-42013.exe
3640	Unicorn-53943.exe
4420	Unicorn-21868.exe
3260	Unicorn-42595.exe
2044	Unicorn-10300.exe
4988	Unicorn-18469.exe
2252	Unicorn-55095.exe
2324	Unicorn-9423.exe
2396	Unicorn-55095.exe
840	Unicorn-59179.exe
1300	Unicorn-9423.exe
2120	Unicorn-3293.exe
388	Unicorn-9158.exe
4848	Unicorn-9423.exe
2024	Unicorn-3668.exe
756	Unicorn-48520.exe
1616	Unicorn-20581.exe
5080	Unicorn-30647.exe
4648	Unicorn-26009.exe
4204	Unicorn-39038.exe
3124	Unicorn-46128.exe
4952	Unicorn-25516.exe
4216	Unicorn-21539.exe
2416	Unicorn-55173.exe
1780	Unicorn-34753.exe
4816	Unicorn-14695.exe
1304	Unicorn-34561.exe
2800	Unicorn-13756.exe
2576	Unicorn-45552.exe
4376	Unicorn-45552.exe
1596	Unicorn-45287.exe
1372	Unicorn-34923.exe
2436	Unicorn-54789.exe
3268	Unicorn-20070.exe
1344	Unicorn-37965.exe
3864	Unicorn-46896.exe
4248	Unicorn-46896.exe
3884	Unicorn-46896.exe
4308	Unicorn-6610.exe
2864	Unicorn-56133.exe
3588	Unicorn-36267.exe
1516	Unicorn-36267.exe
1176	Unicorn-21414.exe
2980	Unicorn-8093.exe
228	Unicorn-59895.exe
4928	Unicorn-23077.exe
3456	Unicorn-3211.exe
2304	Unicorn-37773.exe
5304	Unicorn-14524.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
8816	5708	WerFault.exe	171
12072	6360	WerFault.exe	230
2376	14380	WerFault.exe	701

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11587.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16316	dwm.exe
Token: SeChangeNotifyPrivilege	16316	dwm.exe
Token: 33	16316	dwm.exe
Token: SeIncBasePriorityPrivilege	16316	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe
4628	Unicorn-64197.exe
332	Unicorn-13024.exe
3848	Unicorn-46444.exe
3376	Unicorn-41333.exe
3832	Unicorn-55431.exe
3592	Unicorn-62116.exe
2236	Unicorn-61561.exe
4712	Unicorn-41992.exe
2084	Unicorn-43061.exe
2560	Unicorn-42796.exe
2144	Unicorn-23793.exe
4076	Unicorn-32153.exe
3472	Unicorn-58695.exe
1604	Unicorn-12287.exe
2584	Unicorn-16038.exe
4100	Unicorn-42013.exe
3640	Unicorn-53943.exe
3260	Unicorn-42595.exe
2044	Unicorn-10300.exe
4420	Unicorn-21868.exe
4988	Unicorn-18469.exe
2120	Unicorn-3293.exe
2324	Unicorn-9423.exe
2252	Unicorn-55095.exe
388	Unicorn-9158.exe
1300	Unicorn-9423.exe
840	Unicorn-59179.exe
2396	Unicorn-55095.exe
4848	Unicorn-9423.exe
2024	Unicorn-3668.exe
756	Unicorn-48520.exe
1616	Unicorn-20581.exe
5080	Unicorn-30647.exe
4648	Unicorn-26009.exe
4204	Unicorn-39038.exe
4952	Unicorn-25516.exe
4216	Unicorn-21539.exe
2416	Unicorn-55173.exe
1780	Unicorn-34753.exe
4816	Unicorn-14695.exe
1304	Unicorn-34561.exe
2800	Unicorn-13756.exe
4376	Unicorn-45552.exe
2576	Unicorn-45552.exe
3268	Unicorn-20070.exe
1596	Unicorn-45287.exe
1372	Unicorn-34923.exe
2436	Unicorn-54789.exe
1344	Unicorn-37965.exe
3884	Unicorn-46896.exe
3864	Unicorn-46896.exe
4308	Unicorn-6610.exe
4248	Unicorn-46896.exe
3588	Unicorn-36267.exe
2864	Unicorn-56133.exe
2980	Unicorn-8093.exe
228	Unicorn-59895.exe
3456	Unicorn-3211.exe
1176	Unicorn-21414.exe
1516	Unicorn-36267.exe
4928	Unicorn-23077.exe
2304	Unicorn-37773.exe
5304	Unicorn-14524.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4628	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	89
PID 740 wrote to memory of 4628	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	89
PID 740 wrote to memory of 4628	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	89
PID 4628 wrote to memory of 332	4628	Unicorn-64197.exe	95
PID 4628 wrote to memory of 332	4628	Unicorn-64197.exe	95
PID 4628 wrote to memory of 332	4628	Unicorn-64197.exe	95
PID 740 wrote to memory of 3848	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	96
PID 740 wrote to memory of 3848	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	96
PID 740 wrote to memory of 3848	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	96
PID 332 wrote to memory of 3376	332	Unicorn-13024.exe	98
PID 332 wrote to memory of 3376	332	Unicorn-13024.exe	98
PID 332 wrote to memory of 3376	332	Unicorn-13024.exe	98
PID 740 wrote to memory of 3832	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	100
PID 740 wrote to memory of 3832	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	100
PID 740 wrote to memory of 3832	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	100
PID 3848 wrote to memory of 2236	3848	Unicorn-46444.exe	101
PID 3848 wrote to memory of 2236	3848	Unicorn-46444.exe	101
PID 3848 wrote to memory of 2236	3848	Unicorn-46444.exe	101
PID 4628 wrote to memory of 3592	4628	Unicorn-64197.exe	99
PID 4628 wrote to memory of 3592	4628	Unicorn-64197.exe	99
PID 4628 wrote to memory of 3592	4628	Unicorn-64197.exe	99
PID 3832 wrote to memory of 4712	3832	Unicorn-55431.exe	104
PID 3832 wrote to memory of 4712	3832	Unicorn-55431.exe	104
PID 3832 wrote to memory of 4712	3832	Unicorn-55431.exe	104
PID 3376 wrote to memory of 2084	3376	Unicorn-41333.exe	105
PID 3376 wrote to memory of 2084	3376	Unicorn-41333.exe	105
PID 3376 wrote to memory of 2084	3376	Unicorn-41333.exe	105
PID 740 wrote to memory of 2560	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	106
PID 740 wrote to memory of 2560	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	106
PID 740 wrote to memory of 2560	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	106
PID 3592 wrote to memory of 2144	3592	Unicorn-62116.exe	107
PID 3592 wrote to memory of 2144	3592	Unicorn-62116.exe	107
PID 3592 wrote to memory of 2144	3592	Unicorn-62116.exe	107
PID 4628 wrote to memory of 3472	4628	Unicorn-64197.exe	108
PID 4628 wrote to memory of 3472	4628	Unicorn-64197.exe	108
PID 4628 wrote to memory of 3472	4628	Unicorn-64197.exe	108
PID 332 wrote to memory of 1604	332	Unicorn-13024.exe	110
PID 332 wrote to memory of 1604	332	Unicorn-13024.exe	110
PID 332 wrote to memory of 1604	332	Unicorn-13024.exe	110
PID 2236 wrote to memory of 4076	2236	Unicorn-61561.exe	109
PID 2236 wrote to memory of 4076	2236	Unicorn-61561.exe	109
PID 2236 wrote to memory of 4076	2236	Unicorn-61561.exe	109
PID 3848 wrote to memory of 2584	3848	Unicorn-46444.exe	111
PID 3848 wrote to memory of 2584	3848	Unicorn-46444.exe	111
PID 3848 wrote to memory of 2584	3848	Unicorn-46444.exe	111
PID 4712 wrote to memory of 4100	4712	Unicorn-41992.exe	112
PID 4712 wrote to memory of 4100	4712	Unicorn-41992.exe	112
PID 4712 wrote to memory of 4100	4712	Unicorn-41992.exe	112
PID 3832 wrote to memory of 3640	3832	Unicorn-55431.exe	113
PID 3832 wrote to memory of 3640	3832	Unicorn-55431.exe	113
PID 3832 wrote to memory of 3640	3832	Unicorn-55431.exe	113
PID 2560 wrote to memory of 4420	2560	Unicorn-42796.exe	114
PID 2560 wrote to memory of 4420	2560	Unicorn-42796.exe	114
PID 2560 wrote to memory of 4420	2560	Unicorn-42796.exe	114
PID 740 wrote to memory of 3260	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	115
PID 740 wrote to memory of 3260	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	115
PID 740 wrote to memory of 3260	740	cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe	115
PID 2084 wrote to memory of 2044	2084	Unicorn-43061.exe	116
PID 2084 wrote to memory of 2044	2084	Unicorn-43061.exe	116
PID 2084 wrote to memory of 2044	2084	Unicorn-43061.exe	116
PID 3472 wrote to memory of 4988	3472	Unicorn-58695.exe	117
PID 3472 wrote to memory of 4988	3472	Unicorn-58695.exe	117
PID 3472 wrote to memory of 4988	3472	Unicorn-58695.exe	117
PID 4076 wrote to memory of 2324	4076	Unicorn-32153.exe	118

C:\Users\Admin\AppData\Local\Temp\cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe
"C:\Users\Admin\AppData\Local\Temp\cf3e47f315f281e62257abdc953bb1535444329997f9886fb9575288c2ac2518N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        9⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        10⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        10⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41382.exe
        10⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        10⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        9⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        9⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
        9⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        9⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9703.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        9⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63738.exe
        9⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        9⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        9⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        8⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
        8⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        9⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        9⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41086.exe
        8⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        8⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51101.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        7⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        7⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        9⤵
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45590.exe
        9⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        8⤵
        
        PID:18288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        8⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        6⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        8⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        7⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        6⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50124.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        8⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        9⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        9⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        9⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50796.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        8⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        7⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exe
        8⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        7⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        6⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        7⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        6⤵
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49683.exe
        6⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61949.exe
        7⤵
        
        PID:17836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        6⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
        6⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        5⤵
        
        PID:412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
        5⤵
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        9⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        9⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        8⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        8⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        7⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
        6⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        7⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25327.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58191.exe
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        8⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        7⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55308.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        7⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22917.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        6⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        6⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        6⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55813.exe
        7⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37194.exe
        6⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
        5⤵
        
        PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        8⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 652
        8⤵
        Program crash
        
        PID:12072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 640
        7⤵
        Program crash
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        7⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11778.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        7⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17067.exe
        6⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        7⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        6⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28116.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        5⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
        5⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6785.exe
        5⤵
        
        PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        7⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        7⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
        5⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        6⤵
        
        PID:17184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exe
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63534.exe
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        5⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
        5⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
      4⤵
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
      4⤵
      PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        8⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        9⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
        8⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        8⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        7⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
        6⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        8⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33751.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        7⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60004.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        7⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26132.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4011.exe
        7⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-770.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10838.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        7⤵
        
        PID:18352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        7⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        6⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        6⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        7⤵
        
        PID:17840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        8⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        8⤵
        
        PID:14380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14380 -s 444
        9⤵
        Program crash
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30806.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        7⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        7⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        6⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        7⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9055.exe
        7⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50796.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        5⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        5⤵
        
        PID:14492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39901.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        7⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        6⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        5⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        5⤵
        
        PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        5⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        5⤵
        
        PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50395.exe
      4⤵
      PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
      4⤵
      PID:12512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      4⤵
      PID:14092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11867.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        8⤵
        
        PID:17876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31678.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        7⤵
        
        PID:17732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        7⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        6⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15394.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47754.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        5⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        6⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38010.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        5⤵
        
        PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62099.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        7⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
        7⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        5⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        5⤵
        
        PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
      4⤵
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
      4⤵
      PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      4⤵
      PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        5⤵
        
        PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        5⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        5⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
        5⤵
        
        PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
      4⤵
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
      4⤵
      PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
      4⤵
      PID:17316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37965.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59517.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
      4⤵
      PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        5⤵
        
        PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
      4⤵
      PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35431.exe
    3⤵
    PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29969.exe
      4⤵
      PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        5⤵
        
        PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
      4⤵
      PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      4⤵
      PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50240.exe
    3⤵
    PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
    3⤵
    PID:12380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
    3⤵
    PID:14540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40752.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        9⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        9⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        9⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        9⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        9⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        8⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        8⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57490.exe
        8⤵
        
        PID:18304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        8⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        7⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        8⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        8⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        8⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        7⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        7⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        7⤵
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
        7⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
        6⤵
        
        PID:18368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
        6⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
        7⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        8⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        8⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        7⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        7⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        7⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        6⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        6⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39003.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
        8⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38966.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        7⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
        8⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        7⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        7⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        6⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
        7⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25850.exe
        5⤵
        
        PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        7⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        7⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-931.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21345.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
        6⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        5⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        6⤵
        
        PID:18340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45924.exe
        5⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        5⤵
        
        PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58755.exe
      4⤵
      PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        5⤵
        
        PID:17260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
      4⤵
      PID:12876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      4⤵
      PID:16796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      4⤵
      PID:11928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16038.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        8⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        7⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        6⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        6⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        5⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        5⤵
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52153.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        7⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16661.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43116.exe
        5⤵
        
        PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
      4⤵
      PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        5⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        6⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
      4⤵
      PID:12428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      4⤵
      PID:16960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23077.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        5⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        5⤵
        
        PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
      4⤵
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        5⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        6⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29746.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        5⤵
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        5⤵
        
        PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
      4⤵
      PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
      4⤵
      PID:12912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51564.exe
      4⤵
      PID:10220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
    3⤵
    PID:9140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
    3⤵
    PID:12364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
    3⤵
    PID:14524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
    3⤵
    PID:6548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41992.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20581.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25731.exe
        8⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        8⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        8⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        7⤵
        
        PID:17568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        7⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52510.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        6⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        8⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        8⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        8⤵
        
        PID:18232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        7⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42628.exe
        7⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        6⤵
        
        PID:18212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        6⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58567.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe
        8⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29746.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        7⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        7⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50944.exe
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        7⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        7⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        6⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
        6⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        6⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        5⤵
        
        PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38099.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        7⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        5⤵
        
        PID:18328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe
        5⤵
        
        PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
      4⤵
      PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
      4⤵
      PID:14208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        8⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exe
        7⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        7⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62998.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        6⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        6⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        7⤵
        
        PID:18360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        7⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        5⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56197.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        6⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50944.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        5⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        5⤵
        
        PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
      4⤵
      PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        5⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64941.exe
        6⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        5⤵
        
        PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
      4⤵
      PID:17308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        5⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58749.exe
        7⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        6⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
        5⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        6⤵
        
        PID:18144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        5⤵
        
        PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        5⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        5⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe
        5⤵
        
        PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
      4⤵
      PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
      4⤵
      PID:13112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
      4⤵
      PID:17176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        5⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        5⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61575.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
      4⤵
      PID:2448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
    3⤵
    PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
      4⤵
      PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      4⤵
      PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
      4⤵
      PID:11088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
    3⤵
    PID:9116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
    3⤵
    PID:12488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
    3⤵
    PID:16364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35592.exe
        7⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
        7⤵
        
        PID:18176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        6⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        6⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27365.exe
        6⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        6⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47754.exe
        5⤵
        
        PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
      4⤵
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        5⤵
        
        PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2925.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      4⤵
      PID:180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
      4⤵
      PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6610.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8100.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3175.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        5⤵
        
        PID:13904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        5⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exe
        5⤵
        
        PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
      4⤵
      PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
      4⤵
      PID:12848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      4⤵
      PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43091.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      4⤵
      PID:1800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
    3⤵
    PID:11948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
    3⤵
    PID:13484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
    3⤵
    PID:9892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
      4⤵
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        5⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        5⤵
        
        PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        5⤵
        
        PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8990.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
      4⤵
      PID:13460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34798.exe
      4⤵
      PID:8296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
    3⤵
    PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22512.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46338.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
      4⤵
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
      4⤵
      PID:12404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
    3⤵
    PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
      4⤵
      PID:12964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41358.exe
    3⤵
    PID:8764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
    3⤵
    PID:14436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
    3⤵
    PID:4512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        6⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        6⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57762.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23838.exe
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57776.exe
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
      4⤵
      PID:17236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
    3⤵
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
      4⤵
      PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        5⤵
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
      4⤵
      PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe
      4⤵
      PID:10244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
    3⤵
    PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
      4⤵
      PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
      4⤵
      PID:18152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
      4⤵
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
    3⤵
    PID:10332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
    3⤵
    PID:14064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
  2⤵
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
    3⤵
    PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      4⤵
      PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
      4⤵
      PID:540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
    3⤵
    PID:9836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exe
    3⤵
    PID:13708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
    3⤵
    PID:17476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
  2⤵
  PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
    3⤵
    PID:11660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
    3⤵
    PID:17200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
  2⤵
  PID:9512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
  2⤵
  PID:13852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
  2⤵
  PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4220,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5708 -ip 5708
1⤵
PID:8344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 6360 -ip 6360
1⤵
PID:10840

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:16316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe

Filesize
468KB

MD5
cfb78a45b763c4a8e8bd99a49ff664d9

SHA1
91949587a2e50303d008a3373fc1267af4ea84ba

SHA256
7521af86b9596fd666d6a3653473b98fe6b8dd3ab5759ae3334fe56bdf3dc007

SHA512
92b79ccba85f3417a930420c44456e157107a068f9d64b03da4b996a35677f7951d5066cef429ada21aa26eae52687070d2eb3359e92c30d1857ed80ec3925d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe

Filesize
468KB

MD5
9903ca9ca9d9ebb3f6458218e0b9015a

SHA1
a044300888ba481d6aa1b21f2105e0120a272287

SHA256
15b0b4c0b848c534f66e330fdce69dc5f7bdd538e14f7fb8df95fac37b69ff9e

SHA512
8c4ac68a7d8eb0274a91fb8ec4c8c2f65776057ae70ee4dce08050fd018e500aeca1b58d5b9f8cbd876c147913be8ea48b39d900fa8e27739a478bb15741e3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe

Filesize
468KB

MD5
f62720d8086e15a3fc4fe6ce86ad3477

SHA1
c585a767f3dd0831aaa10abf6fae20367730e384

SHA256
c683c25aa3e46a216f9b761aa27b5ac1bd0bd1b79505b9a1626c3198608f1a29

SHA512
9dc3302e94ab3185cbc6b85511f307731af44bac136d0ca29b4f2b9968ab667b27333243a5be0ae26d7bb6618febaf45ef2063478cd5df012998ca8caada139a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16038.exe

Filesize
468KB

MD5
24f4c7f5f77da5c3e8fbbbfb3ba0ab0f

SHA1
2f16925083344329abb910485dabc52bd3f0fee0

SHA256
f80f757b140ff0648ccb6d4547ab964fb0a39dc648cec67139a2e637abbf5831

SHA512
5b5600388bdd784099e6ce9f804a6a1a8e9882f4706fa6944b54e493d925e4db8ae494fa1befba5672b0f00d7a62033d60f85cbbbaffb5aaa263f3138dff93f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe

Filesize
468KB

MD5
3a31684df6d585357681d89b6d39fc7f

SHA1
aa1614606ec9d49294b214d5c129f858cb452178

SHA256
4aea5358319959fe2f9569a2f77801bf8acc55fc5e15218d1cd09e099b7cd15f

SHA512
fc9dc849278ebc99e59be70c3ad8afe084fa76f8e096f7aa90ed45d47f5f40f453a91f2c51328675ee10431e40e49aa6f5f1fda9282d9d326f95b362f7465fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20581.exe

Filesize
468KB

MD5
67b223277b55407f5ed87edc5b16243b

SHA1
04db802ab057338691fe87735e1da5876f5bab09

SHA256
f2fe6d3dbd8367291a358ba930ed5583e4b7cf65888b12d6d9adeced4a31aa03

SHA512
c7c1bf93412b09f8dc182f01c1d3042fe8fc17783a9e175ccc7bfbbc95b945416af0742ad00b613b2879960accb5f4e1dc74cccbc714af95a1b33797e168896b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe

Filesize
468KB

MD5
2e625a1db1779c86c41c2fbfcf5904ca

SHA1
4498f199dccaf17e7f3d3391497b944499ab2d86

SHA256
7fa12fa1901bf0750ccfb612289ef234715afaedef850901704ec13abbdd2d01

SHA512
8f5d0f37889ecfc7954a37f66286a1afc6660c1dd63b9a67d9e73e035a5dad8a4fc28d1eb38e1372ed98251ce0623b35d151a70dd68ecb581eae08568ec6c748

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23793.exe

Filesize
468KB

MD5
fca81e203f6053ab7e60efb9e6193cba

SHA1
e38dbedfc3fb2dc19a50a961214b4e799c539424

SHA256
e9701d9b9844d3e0be9a10641ddec5c79b9a827269d7d7cdbc98f667b3007b15

SHA512
a1bc3242a3b9dc5797de39fb024153f030b93918b6148fa9e3e0bad4cdfc2ea3c206fb7da7eac0d50196609bfb792ab935f4ecddb0459000aae1a318f15cb02b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe

Filesize
468KB

MD5
a625ba3d98bcec992334c669ec642dc5

SHA1
ab600b16070772867ffc096df31458a510baa570

SHA256
a1d02709ec83547c7fe207fbc04b5e70e1c58e37af53c616862f9a1d063ac742

SHA512
b4e5654ef590677a4b21d005a0613327c6aca11134875c3e0f190988518c0a291218b17708e974b1adbbe280f5b3b1bce2e10c6f216cbcfea14895a323b49a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe

Filesize
468KB

MD5
1460718b32686bbaf59df9885389b53c

SHA1
daa7bd7605d56a5a1c105e5b20e72e4344a65223

SHA256
8406d6abfe9a17f00e02fc29283fd15174021d51b4ea3f7b4360a0931f704f83

SHA512
0d52f846e7eeed494bb5cebc5db42a767c6f28125345cf4ae75d02e83b031a82aa3bce895e692bfe6a4a7e9e8c1e46b3fad17e22897a7368804b2aab1c5fa437

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe

Filesize
468KB

MD5
b852d11a6f4d9fb3edf31db23d55c7bf

SHA1
06b222432dc02353193fe9562c6a29cf1462167e

SHA256
2ad2d3ca7969a450602e556d2edd8c10830393ba5c78edda2bc821109b61fe61

SHA512
82f0510b488ea0b3cb8b50a20d2d2e51d82e864925de3aa4fd52d67badf145f3d20f874598b24a5b68ccd23ccd920aa24442251352dc316e1f6d043391401cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe

Filesize
468KB

MD5
ec1d3f496e873eb6ac93f09797ce999c

SHA1
c43358a1a1d27dbe220e07f33e8f7db66c949221

SHA256
541cb9312492d2c69558d315b221a9153e9cb2dbaf4429836445bbea8ec64078

SHA512
38f45ca9901ef1794b668fea3d1a010c08aa4ba44e4bed78f597cc5f9ac2e7882a7aa5203f22f35fbf47be9f5a9bd314618504241b99011a6d0b63cfd782b27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe

Filesize
468KB

MD5
c42a46b7008165afc56e3ce8e8589403

SHA1
dc63092ebebc622e6e0dfdda97c8989a148638b4

SHA256
3ca81d9b05662a88c810a814dc610e90f15be859521a84d0943365fd95853b95

SHA512
dc0b7b26b66ed615c17b66357ea080d7e22fc47dd1ee094621f08d807396dbfedae89821968b0fd9b53e1f023a8a53a14a9a8536d0ad2b993b50bffedcb72df8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe

Filesize
468KB

MD5
f5e850530825f2df056c62c8c0f28251

SHA1
abb1c73b112bf5bc42efd2733804abd65e5d2b4e

SHA256
05fe0a5fba60fbb1455260a537c380c28ffd0012880ed225fd163d6e98c237b9

SHA512
733475f0188764ab8e559139d5421b859ef538485f34cc656ef3472d366980c48568b9b26fe23fa0f717c2e58768c13d0e7ab36e34171dba1356a19a8e877723

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41992.exe

Filesize
468KB

MD5
9587437b03e72f0b33c3e6459f4a164c

SHA1
17411317dc62c58da730012f4dae52c59a56334f

SHA256
3ed87058d9e97395e960a8eaf93d8240fdcebd685ca00f8a55b8cacaf3a34c21

SHA512
5a29fad6403619fd0b8b5fbbe763b77360c7d1965e2403e590e0672f54ce39a1f5f18945788025b1656c6c8bdd46fe3c5eccecea7c6fb513b24059ddb4ad85f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe

Filesize
468KB

MD5
51fa82ecc3d9eb1bb53d98d9f96aa707

SHA1
0a271ace0cf82d4cdd941c9de3fe6846db2e6329

SHA256
c4769150ffb963e4acc89552a5701ac4881725ccf8ade239d6c369648d39f32a

SHA512
2c0989f4f5648d009de3ca82d7d61c5923a4bfd9d1372e237a17400ebf8524ead5bfdc810db52aabd32b111dd204a93d5d8de83cc741d39ab10d2b06ba9aae23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe

Filesize
468KB

MD5
8be3ca031ab2e21c3521eedc5516528a

SHA1
15e77b263f62c210dff6f245b4ea41c0d1eddc42

SHA256
d52895cb589d8dce596cfa7ef1608b59ceafe0afe8ee260202ec80f2314eb583

SHA512
93cb5d0e197c4fcf0764557920b6bf757504192af72effb05f8eb66a301cddfad921a6492efb929c8cd101944c5957a520cba8b5dd3ae57db56b350a2c7e5b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe

Filesize
468KB

MD5
8dce5d670cb3a7b1ab800392c33b3f6f

SHA1
d2c3f37b6c82f63b6724f8f8933d8c54644e0832

SHA256
1627f2539cc840657e0503bcbcb73352038c1afde86916c3be3687a90a558f01

SHA512
730b9df2e915205f96baaff46a1dc676084c4cb20c8baf51b90b4722fb301722a3284478ccabd66d5f46a00191e5c04e20b0b3fdb35ac8d2183d83071409df36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe

Filesize
468KB

MD5
bf07768ee867747bc518f875a8591469

SHA1
5bd6eb95b589156a9d0d5a3377bfd9809ab10977

SHA256
2f6575f46fd76a2e82235da82bcc4137533d58a74e1989a8245e5bbdd12e8b09

SHA512
03a15c10df0d595f6f0c4ec932421ebf93a44cb89ffc22cb57d4ba9dac5b2d532622b4a8b91090d4ec9b7cf98b2acaa1d6e21cb7794711da914df970de2c4ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe

Filesize
468KB

MD5
f1fd0308dce90dd276cf8a173b1b1d52

SHA1
002e2b35996c521c869ded592b6b7ddde6b78a1f

SHA256
73d055c54fd86bb03b1528916b170102dc2c15ede34aee0fdc0d6c0528b9e509

SHA512
e593e6379ab7552578ca1df35adde08fbc43e3f163eba6eec610f8026cc69b920fec0b65ff6cdee2a3c8a8577d20f17d3eba7b05515b3030404ffe0dca2d859e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe

Filesize
468KB

MD5
a064002705d50374d0301e74672d38b4

SHA1
421338014ccb8d9a2ecba5b5fae1f366958441be

SHA256
991d5ea04b6496eea8047335d17132332947bd164047aab99006b204c57028de

SHA512
bf0172aafd521b8dae7f1163a3be87fd132d7c1f3c5b98078b4442f9880348a3484437c38e0d20f096e5f94233ea27e7d27cb99e54756967ee2819bd9c0b4e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe

Filesize
468KB

MD5
c2ac6a51e1d4c1847806927a9fdc7abd

SHA1
ffd01316dd68f567c31966badc8917cc2c214355

SHA256
bd96afb1e8b229ffe7bf11bc6075b48cf5cc73d00c38963dcac3300818e4aaa9

SHA512
ba29f23b88b276e5722dba8778800010c03a3c88e0209ecd011a19e1b0e8d39a73cfaa4c7473c092eda0815a4fd6a3ef6b311c3a57e7e59d5430fa71dc2cb06e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe

Filesize
468KB

MD5
9566cdde0ad707f052e06d97d4eaa781

SHA1
f154d709095639087f8157d38e8ee544aa9cf709

SHA256
6c35218efd2f7f468e3279509ee4bed8268e757f94ad6c651d4f573ed1bc539f

SHA512
4cef0f69b7c99bc75afd1b7ca7997c1f5881f698e422227b4a1239fc88a42cf5bc3891e6bf817f11a837983c4c368e38666fa60eb4098252582849c0d11412b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe

Filesize
468KB

MD5
5c761a5557a9b964237ff77231ee33ee

SHA1
ac3f7904ceb34428310cb6e75dd74cc7cc4aff8b

SHA256
1c0d685ce6698256baf0c86dee85e9f72ffa09d911d120a17e9ad9a1a098ba9b

SHA512
8092fc284c7470b59764d63592ded2709100273f31c2fdbfc0e1a095df1ae54e9b444376c60d53d32fd2b8b64b4af206f9cb038b597f6917d0e5b1673c7451b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe

Filesize
468KB

MD5
08e9df3fdc4ad7ec28fdb05bbd163261

SHA1
ece89902bcff9688d677f97a3bb6415785998efe

SHA256
ffc9e73d8c31352bdb15c07345d36ee3bc4f78f4fd44919b7676ed0901035099

SHA512
d143dcdd2fcef97cd15be56d5cdde2896e4343af80be3d169c16d37338db8ff4bbf9343696c65b26398d1d24feebabd433ffb3075c8d6c2ac5ede5211a211e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe

Filesize
468KB

MD5
d37a11048e80d76fc01b93405140df2e

SHA1
0af9c8a88099ae57fcccba2b848b543c6e2ed760

SHA256
caa7ea2b026886a17b8c4542f5c3fde15b82924148e16c7308064d8c87ecbe92

SHA512
83d70d3ea491539a3e6c56dc0dd0e372990e760248d9341f9e7151cf3499d2c8efe692fdfaf4326909a03a8585f233524f2744081b3eca3dcc71a22a752f9cf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61561.exe

Filesize
468KB

MD5
4a6790d7a8486d002be16b96abd28fa5

SHA1
41456fa06da8cdf963ccd8e9f18797b00f63ed3c

SHA256
51042496025fc6f0b9878c45dcff6802edd64c7f4089ef8b198518544e998e30

SHA512
e33c0548eaf86593058b82be5a431214b2ab11b2c8b94054fcb658a817c8a0fa928f2aa855741296a1e8056e80a3a85e6aebf2a6a2011a47db0ba005eb15542d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe

Filesize
468KB

MD5
04d4e7ed4288b16744774b8d9fa0c359

SHA1
92d8524cf0654f2efe07d392f32a93aa906b9d7c

SHA256
db07b26770f1dc8d04962373cd79c691d609eff5640d409bcdd66fd353c258a6

SHA512
05a1855328c066ecfafaee148c4af3ac4616c1fc3b07cf4ca73d5ebdb203141c6c59b34f214ff3637da198e80cb6bb3566d782d7e2fd02add2d32ccdb967071a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe

Filesize
468KB

MD5
98ec8e779db98287fbc04d4ceff8b922

SHA1
6260c04951639751922d1c8b7d06f2628a4f3a04

SHA256
562086253c959e7aed1277b939c2d4b00bb49964b23aae57fef1af17e2d4ae7e

SHA512
bfff717185d9a70130444be4b790ceca13b4180e05d467eb61f0c25ae643822e1e116f4bed0d412efe5d1dc9dfafcb979698fee26a0ffd74c9fa8015f9ffd3fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe

Filesize
468KB

MD5
067395e6890357af64ecd20e660fe247

SHA1
3bdebac6107396093b74b80bc6837ee7c154e1dd

SHA256
79b04417c6231e28beecf75927aab62a5ce121367797ce2d5f5127e6f817946c

SHA512
26274febda41240c5d051489b352778b7d4c7224e0fa8f9290ede92b4ec148a1da9c05ecda90c6acd782c2f8ddc028a6ab4d7c8e90fdfc3327ebcb2eb6931836

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe

Filesize
468KB

MD5
3eeeb7343c6f04c800c93402ec6c2dd6

SHA1
f9fc4fa0da2c14cab9af8c1560aeb566fdebb454

SHA256
f82a8535904d7b4cbe7887d2371503c80e2488257dfa854f22126f73022d55da

SHA512
d8ab17eaf9c85b396e511253fc6901667c0d585d60853b95122beb426ef0041acff0691b74abcb288b2edf29d7ab36ff83ca0b8dcfa978dfe0548386b9a6aaad

Download Submit