ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8f

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe
Size

468KB
MD5

e23fbd29deb4dce7c2e8e62e04aaa050
SHA1

245678e0e0ed18cad6ed27f52ad19278b418d94d
SHA256

ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8f
SHA512

cda0da32edf532e8df2f5d30f440ae42aab64ebd9afa1bb2e85d6d0f888199c73ffb6397292b85e87fc6aec916298c5d377e48217bede148257182aad0d2aa91
SSDEEP

3072:5ZACogbdhZJBtUYJPzcBff8/EChXsaplnYHCxEuCdk+2A98uUVEh:5Z1oy/BtjP4BfflS5odkRE8uU

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
4972	Unicorn-64199.exe
1796	Unicorn-45759.exe
1272	Unicorn-34061.exe
1500	Unicorn-47871.exe
5064	Unicorn-36173.exe
4660	Unicorn-58077.exe
2276	Unicorn-18021.exe
4920	Unicorn-10642.exe
4724	Unicorn-52230.exe
2796	Unicorn-6293.exe
3204	Unicorn-428.exe
3092	Unicorn-5472.exe
384	Unicorn-11602.exe
3508	Unicorn-58618.exe
3696	Unicorn-58618.exe
2220	Unicorn-49319.exe
2020	Unicorn-48557.exe
2096	Unicorn-12562.exe
3056	Unicorn-12562.exe
3516	Unicorn-58234.exe
4164	Unicorn-20731.exe
2492	Unicorn-16381.exe
5080	Unicorn-22768.exe
4560	Unicorn-6890.exe
1600	Unicorn-6890.exe
3168	Unicorn-19069.exe
4984	Unicorn-65006.exe
3636	Unicorn-6698.exe
4472	Unicorn-6698.exe
4820	Unicorn-8928.exe
3352	Unicorn-39371.exe
1624	Unicorn-35649.exe
4336	Unicorn-56631.exe
4428	Unicorn-53294.exe
4492	Unicorn-7622.exe
3640	Unicorn-15791.exe
916	Unicorn-28043.exe
2984	Unicorn-28043.exe
2644	Unicorn-38057.exe
4304	Unicorn-24321.exe
3900	Unicorn-31172.exe
2572	Unicorn-39838.exe
216	Unicorn-20237.exe
3256	Unicorn-14637.exe
224	Unicorn-725.exe
4792	Unicorn-25303.exe
3348	Unicorn-33279.exe
1368	Unicorn-42001.exe
4844	Unicorn-606.exe
2452	Unicorn-8774.exe
4112	Unicorn-9329.exe
2100	Unicorn-22925.exe
3288	Unicorn-42791.exe
1180	Unicorn-55043.exe
4836	Unicorn-6034.exe
3144	Unicorn-6034.exe
888	Unicorn-13440.exe
4080	Unicorn-18021.exe
4772	Unicorn-63958.exe
3328	Unicorn-12156.exe
3464	Unicorn-24408.exe
3744	Unicorn-22179.exe
752	Unicorn-63766.exe
3456	Unicorn-63766.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
816	3456	WerFault.exe	154
1160	752	WerFault.exe	153
16920	9316	WerFault.exe	429
14660	15732	WerFault.exe	761

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9013.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2412658365-3084825385-3340777666-1000\{4CAB0B3C-C07F-4B67-BADD-C495C2C4E6EA}	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15940	dwm.exe
Token: SeChangeNotifyPrivilege	15940	dwm.exe
Token: 33	15940	dwm.exe
Token: SeIncBasePriorityPrivilege	15940	dwm.exe
Token: SeShutdownPrivilege	16552	explorer.exe
Token: SeCreatePagefilePrivilege	16552	explorer.exe
Token: SeShutdownPrivilege	16552	explorer.exe
Token: SeCreatePagefilePrivilege	16552	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe
4972	Unicorn-64199.exe
1272	Unicorn-34061.exe
1796	Unicorn-45759.exe
1500	Unicorn-47871.exe
5064	Unicorn-36173.exe
4660	Unicorn-58077.exe
2276	Unicorn-18021.exe
2796	Unicorn-6293.exe
3204	Unicorn-428.exe
4920	Unicorn-10642.exe
4724	Unicorn-52230.exe
3092	Unicorn-5472.exe
384	Unicorn-11602.exe
3508	Unicorn-58618.exe
3696	Unicorn-58618.exe
2220	Unicorn-49319.exe
2020	Unicorn-48557.exe
2096	Unicorn-12562.exe
3056	Unicorn-12562.exe
3516	Unicorn-58234.exe
2492	Unicorn-16381.exe
4164	Unicorn-20731.exe
5080	Unicorn-22768.exe
4560	Unicorn-6890.exe
1600	Unicorn-6890.exe
4984	Unicorn-65006.exe
3168	Unicorn-19069.exe
3636	Unicorn-6698.exe
4472	Unicorn-6698.exe
4820	Unicorn-8928.exe
3352	Unicorn-39371.exe
1624	Unicorn-35649.exe
4336	Unicorn-56631.exe
4492	Unicorn-7622.exe
4428	Unicorn-53294.exe
3640	Unicorn-15791.exe
916	Unicorn-28043.exe
4304	Unicorn-24321.exe
2644	Unicorn-38057.exe
216	Unicorn-20237.exe
2984	Unicorn-28043.exe
3900	Unicorn-31172.exe
2572	Unicorn-39838.exe
3256	Unicorn-14637.exe
224	Unicorn-725.exe
4792	Unicorn-25303.exe
3348	Unicorn-33279.exe
1368	Unicorn-42001.exe
2452	Unicorn-8774.exe
4112	Unicorn-9329.exe
4844	Unicorn-606.exe
2100	Unicorn-22925.exe
3288	Unicorn-42791.exe
1180	Unicorn-55043.exe
4836	Unicorn-6034.exe
3144	Unicorn-6034.exe
4080	Unicorn-18021.exe
3744	Unicorn-22179.exe
3504	Unicorn-6397.exe
888	Unicorn-13440.exe
4772	Unicorn-63958.exe
3328	Unicorn-12156.exe
3464	Unicorn-24408.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 4972	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	84
PID 2892 wrote to memory of 4972	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	84
PID 2892 wrote to memory of 4972	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	84
PID 4972 wrote to memory of 1796	4972	Unicorn-64199.exe	85
PID 4972 wrote to memory of 1796	4972	Unicorn-64199.exe	85
PID 4972 wrote to memory of 1796	4972	Unicorn-64199.exe	85
PID 2892 wrote to memory of 1272	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	86
PID 2892 wrote to memory of 1272	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	86
PID 2892 wrote to memory of 1272	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	86
PID 1796 wrote to memory of 1500	1796	Unicorn-45759.exe	87
PID 1796 wrote to memory of 1500	1796	Unicorn-45759.exe	87
PID 1796 wrote to memory of 1500	1796	Unicorn-45759.exe	87
PID 4972 wrote to memory of 5064	4972	Unicorn-64199.exe	88
PID 4972 wrote to memory of 5064	4972	Unicorn-64199.exe	88
PID 4972 wrote to memory of 5064	4972	Unicorn-64199.exe	88
PID 2892 wrote to memory of 4660	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	89
PID 2892 wrote to memory of 4660	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	89
PID 2892 wrote to memory of 4660	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	89
PID 1272 wrote to memory of 2276	1272	Unicorn-34061.exe	94
PID 1272 wrote to memory of 2276	1272	Unicorn-34061.exe	94
PID 1272 wrote to memory of 2276	1272	Unicorn-34061.exe	94
PID 1500 wrote to memory of 4920	1500	Unicorn-47871.exe	95
PID 1500 wrote to memory of 4920	1500	Unicorn-47871.exe	95
PID 1500 wrote to memory of 4920	1500	Unicorn-47871.exe	95
PID 4972 wrote to memory of 3204	4972	Unicorn-64199.exe	97
PID 4972 wrote to memory of 3204	4972	Unicorn-64199.exe	97
PID 4972 wrote to memory of 3204	4972	Unicorn-64199.exe	97
PID 1796 wrote to memory of 4724	1796	Unicorn-45759.exe	96
PID 1796 wrote to memory of 4724	1796	Unicorn-45759.exe	96
PID 1796 wrote to memory of 4724	1796	Unicorn-45759.exe	96
PID 2892 wrote to memory of 2796	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	98
PID 2892 wrote to memory of 2796	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	98
PID 2892 wrote to memory of 2796	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	98
PID 1272 wrote to memory of 3092	1272	Unicorn-34061.exe	100
PID 1272 wrote to memory of 3092	1272	Unicorn-34061.exe	100
PID 1272 wrote to memory of 3092	1272	Unicorn-34061.exe	100
PID 2276 wrote to memory of 384	2276	Unicorn-18021.exe	101
PID 2276 wrote to memory of 384	2276	Unicorn-18021.exe	101
PID 2276 wrote to memory of 384	2276	Unicorn-18021.exe	101
PID 4660 wrote to memory of 3508	4660	Unicorn-58077.exe	102
PID 4660 wrote to memory of 3508	4660	Unicorn-58077.exe	102
PID 4660 wrote to memory of 3508	4660	Unicorn-58077.exe	102
PID 5064 wrote to memory of 3696	5064	Unicorn-36173.exe	103
PID 5064 wrote to memory of 3696	5064	Unicorn-36173.exe	103
PID 5064 wrote to memory of 3696	5064	Unicorn-36173.exe	103
PID 2796 wrote to memory of 2220	2796	Unicorn-6293.exe	104
PID 2796 wrote to memory of 2220	2796	Unicorn-6293.exe	104
PID 2796 wrote to memory of 2220	2796	Unicorn-6293.exe	104
PID 2892 wrote to memory of 2020	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	105
PID 2892 wrote to memory of 2020	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	105
PID 2892 wrote to memory of 2020	2892	ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe	105
PID 4920 wrote to memory of 2096	4920	Unicorn-10642.exe	106
PID 4920 wrote to memory of 2096	4920	Unicorn-10642.exe	106
PID 4920 wrote to memory of 2096	4920	Unicorn-10642.exe	106
PID 3204 wrote to memory of 3056	3204	Unicorn-428.exe	107
PID 3204 wrote to memory of 3056	3204	Unicorn-428.exe	107
PID 3204 wrote to memory of 3056	3204	Unicorn-428.exe	107
PID 1500 wrote to memory of 3516	1500	Unicorn-47871.exe	108
PID 1500 wrote to memory of 3516	1500	Unicorn-47871.exe	108
PID 1500 wrote to memory of 3516	1500	Unicorn-47871.exe	108
PID 4724 wrote to memory of 4164	4724	Unicorn-52230.exe	109
PID 4724 wrote to memory of 4164	4724	Unicorn-52230.exe	109
PID 4724 wrote to memory of 4164	4724	Unicorn-52230.exe	109
PID 4972 wrote to memory of 2492	4972	Unicorn-64199.exe	110

C:\Users\Admin\AppData\Local\Temp\ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe
"C:\Users\Admin\AppData\Local\Temp\ba8fb873f7b5d964c4f6c68a9e44625eef0ca59dc65c35e1fa9c17b2530ddf8fN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45759.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        9⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        10⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        10⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        10⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        9⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        9⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        9⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        9⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        9⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        9⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        8⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        7⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        9⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        9⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14529.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        8⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        7⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        7⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4379.exe
        7⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        9⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        10⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        10⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        10⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        9⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        9⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        8⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        9⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe
        9⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        8⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        8⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        7⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        6⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        9⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        10⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        10⤵
        
        PID:16448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        9⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        9⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        9⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        8⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28090.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        7⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28496.exe
        7⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        8⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        8⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        7⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        6⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        9⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        10⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54426.exe
        10⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        10⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        9⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        9⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        9⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        9⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52021.exe
        9⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
        9⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16832.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        8⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54846.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        6⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        9⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
        9⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        8⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        8⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        7⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        6⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        8⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
        6⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
        6⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        9⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
        9⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        9⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18664.exe
        8⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        7⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        8⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        8⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10881.exe
        7⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43102.exe
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        7⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
        7⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        6⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20951.exe
        7⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        6⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30840.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        6⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        5⤵
        
        PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52230.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55619.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        9⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        10⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        10⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        9⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        9⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        8⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        8⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        8⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65125.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44950.exe
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        8⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        8⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        8⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        7⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61639.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
        8⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        7⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62282.exe
        6⤵
        
        PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        6⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        8⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        9⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        9⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61752.exe
        7⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        6⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32661.exe
        8⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        8⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        8⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        6⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        7⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        6⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        5⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
        8⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        7⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        6⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        5⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        5⤵
        Executes dropped EXE
        
        PID:752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 212
        6⤵
        Program crash
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        6⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45385.exe
        6⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        6⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53086.exe
        5⤵
        
        PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7216.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        7⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        6⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        5⤵
        
        PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
      4⤵
      PID:460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18037.exe
        5⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22089.exe
      4⤵
      PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        5⤵
        
        PID:9316
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9316 -s 652
        6⤵
        Program crash
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        5⤵
        
        PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
      4⤵
      PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
      4⤵
      PID:14344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
        7⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        8⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9525.exe
        9⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        7⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        7⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        6⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-288.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        6⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        6⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        8⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        8⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
        7⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        7⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        6⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        7⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47227.exe
        6⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38721.exe
        5⤵
        
        PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        8⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
        8⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57482.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
        7⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        6⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        8⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        7⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
        6⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        5⤵
        
        PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        7⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19384.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        6⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        6⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        6⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
        6⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        5⤵
        
        PID:17332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
      4⤵
      PID:16888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-428.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        9⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        9⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        8⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14529.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
        7⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        8⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        9⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        7⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10392.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40256.exe
        7⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        6⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        7⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        7⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37099.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        7⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        6⤵
        
        PID:17288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        6⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        7⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        6⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
        5⤵
        
        PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        8⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        7⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        7⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        6⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47534.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        7⤵
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        7⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        6⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        5⤵
        
        PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
      4⤵
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        6⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        6⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        5⤵
        
        PID:11908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
      4⤵
      PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36431.exe
      4⤵
      PID:15328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        6⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
        8⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
        8⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        7⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        6⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        6⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28614.exe
        6⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        5⤵
        
        PID:15732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15732 -s 472
        6⤵
        Program crash
        
        PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
      4⤵
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        7⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        6⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        6⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        5⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        6⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        5⤵
        
        PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        5⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        5⤵
        
        PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
      4⤵
      PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
      4⤵
      PID:14788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
      4⤵
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
      4⤵
      PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
      4⤵
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
        6⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        7⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        6⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58494.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        5⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        5⤵
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        5⤵
        
        PID:13392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
      4⤵
      PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        5⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        5⤵
        
        PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
      4⤵
      PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        6⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        5⤵
        
        PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
      4⤵
      PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
      4⤵
      PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
    3⤵
    PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
      4⤵
      PID:13968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
      4⤵
      PID:14372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
    3⤵
    PID:9920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe
    3⤵
    PID:14444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34061.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        7⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        9⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        9⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
        9⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        9⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        8⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        8⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        7⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        9⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        8⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        8⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        7⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        5⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        8⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        7⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43398.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39977.exe
        5⤵
        
        PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        5⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60713.exe
        6⤵
        
        PID:17288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        6⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        5⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46397.exe
        6⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
      4⤵
      PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        5⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
        5⤵
        
        PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
      4⤵
      PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
      4⤵
      PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30643.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        9⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        9⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        8⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        7⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28614.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
        6⤵
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        5⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exe
        8⤵
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58650.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17516.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        7⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        6⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        5⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        6⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        5⤵
        
        PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        6⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        7⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        7⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        7⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        6⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        5⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        6⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31280.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
      4⤵
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
      4⤵
      PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
      4⤵
      PID:15644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        7⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        6⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        6⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        5⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        6⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        5⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        5⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28233.exe
        5⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
      4⤵
      PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        5⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        5⤵
        
        PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
      4⤵
      PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
      4⤵
      PID:9708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        6⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
        5⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
      4⤵
      PID:15372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
    3⤵
    PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      4⤵
      PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
      4⤵
      PID:13124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
      4⤵
      PID:16908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
    3⤵
    PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
      4⤵
      PID:13100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
      4⤵
      PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
    3⤵
    PID:12068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    3⤵
    PID:16536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53697.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        7⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        7⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        6⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        7⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        6⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        7⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        7⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        6⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        6⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        6⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        5⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        6⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56513.exe
        5⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        6⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
        5⤵
        
        PID:16028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        5⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52021.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        5⤵
        
        PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
      4⤵
      PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        5⤵
        
        PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
      4⤵
      PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
      4⤵
      PID:16120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
      4⤵
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        6⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        7⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        6⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        5⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        5⤵
        
        PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        5⤵
        
        PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
      4⤵
      PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
      4⤵
      PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
      4⤵
      PID:15612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
    3⤵
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25004.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
      4⤵
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
      4⤵
      PID:12616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
    3⤵
    PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
      4⤵
      PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44658.exe
        5⤵
        
        PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
      4⤵
      PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
      4⤵
      PID:16480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
    3⤵
    PID:9000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
    3⤵
    PID:13856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        9⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        8⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        8⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32971.exe
        7⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
        6⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13121.exe
        7⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        6⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        6⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        7⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        6⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exe
        6⤵
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        6⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        6⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        5⤵
        
        PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        6⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe
        6⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28021.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        5⤵
        
        PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
      4⤵
      PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        5⤵
        
        PID:15884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
      4⤵
      PID:15976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        6⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        6⤵
        
        PID:14844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16059.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59226.exe
        5⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        5⤵
        
        PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe
        6⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        5⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
      4⤵
      PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43502.exe
      4⤵
      PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21098.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
        5⤵
        
        PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
      4⤵
      PID:1140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        6⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
        5⤵
        
        PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      4⤵
      PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      4⤵
      PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
    3⤵
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      4⤵
      PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
      4⤵
      PID:12192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
    3⤵
    PID:14040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
    3⤵
    - Executes dropped EXE
    PID:3456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 212
      4⤵
      Program crash
      PID:816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
      4⤵
      PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        5⤵
        
        PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
      4⤵
      PID:15492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
    3⤵
    PID:14856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
    3⤵
    PID:168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
    3⤵
    PID:7244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
    3⤵
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        6⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23903.exe
        6⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        5⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        5⤵
        
        PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
      4⤵
      PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        5⤵
        
        PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
      4⤵
      PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
    3⤵
    PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
      4⤵
      PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8406.exe
        5⤵
        
        PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
      4⤵
      PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
    3⤵
    PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
      4⤵
      PID:7000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
    3⤵
    PID:13616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
    3⤵
    PID:16956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
  2⤵
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      4⤵
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        5⤵
        
        PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
      4⤵
      PID:11404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
    3⤵
    PID:8404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
    3⤵
    PID:15020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
  2⤵
  PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
    3⤵
    PID:8720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
    3⤵
    PID:13984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25745.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25745.exe
  2⤵
  PID:9944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
    3⤵
    PID:13568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
    3⤵
    PID:5584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
  2⤵
  PID:13828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
  2⤵
  PID:14640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3456 -ip 3456
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 752 -ip 752
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 15724 -ip 15724
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 15976 -ip 15976
1⤵
PID:3284

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:16552

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1140
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:14720

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe

Filesize
468KB

MD5
92a092288bda32e7a5a973d1eafc8619

SHA1
db463013189490cbaf5320d7943c9f05959b8a3a

SHA256
9154da9ed2bc1ab031ebb75acf02197035b03d670b8f25ae3e0abe4e5260da05

SHA512
aaffc8f2258e112d1f131f23c7b4007fd1cc9e530df5d3deb38d9455d4e259f0fe13812c8898fb8438a71c5261874807f6a2dbfe1318fe96b8fd0a3644fc97a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe

Filesize
468KB

MD5
06ba1eb4da5c2d2cef3b201b74162085

SHA1
60c1cd34ccc61fc72f1ef8d9ffe21e220d2c4cbe

SHA256
022afe60d04932078b8e3f3f72580f8dc5afac63c023ab692f965b6c61f5d1a5

SHA512
17e90d9cc96364787d1d6e0f961c5463b716b550936ba08771f59ddb9a34b17a3ed0a5d9599805cc49f900b74b8503d0ca949e85bef0d414b06becf59147e6ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe

Filesize
468KB

MD5
3c05fd68fb1cec268950bbb43570cf46

SHA1
0d18322eeeb9c528597f3751507ccd77c2ce9291

SHA256
e9e11c52e9ef45923dec376b67e876b68f3c2a1e2582b644331b2209d9a5beaa

SHA512
b277da791084e3be33dff00042744f7eb1bf3f21256e0f169dcd2b9934add62c0f049416c62811ede2b6434a1c418724ffdbdacca751e5d13ae24d18598903f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe

Filesize
468KB

MD5
b4c653b7d73747f8e7a35c1ca08c9412

SHA1
55abb3a0d25543331c3a3b89205c1833a206d6c5

SHA256
6700dbbb4ff2f0fe8cd92a2b614670b1d439cf85ba27ffa6281b97a0d6182c75

SHA512
f8043a833cccd1179c195e4ca82ff29e684d59350c9b7cdbb390c068e8f1cbefe0958f9733caf6610e3c3fe1a444c75f108afab19a8894f59b96a1116a3c33b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe

Filesize
468KB

MD5
dd1a375be92ca2f08891b35872d42e9e

SHA1
6c59d6a0006e1e19a11d9bfe69f9540c106336ca

SHA256
0242626720f9aa8b1da1495f7d3605a6b88e54f82fefc84f0021682383ac161b

SHA512
080ec252ad589911f2ea943ef77f97e29f4f66379b41a08a3ed72290d1d31ea5d20041fd698d49d592295a1ae4a34d733b09c321afa45d13a2d04d81e45dd6b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe

Filesize
468KB

MD5
9f5f91a134ae8ee459d8355ec7862b3e

SHA1
f55bd73b951dd4ada5a834ea1e9a138159bce614

SHA256
f4bd38e8a1c4df14db61ccb1cfc472464d6400d4a2e38d904575b96d44d0c007

SHA512
7b6b54f6b1565ffeceda882d6bea6cc227e498941dae9c009fd0d19a62f3a9a861a21df3102be093adc341c193184a4080dcc95005dc598dab6e348194191e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20731.exe

Filesize
468KB

MD5
f703eb1e911df056bea31f9170875a32

SHA1
430f2ddae16f7c6244bb89a6d498d6d1a18b6d7a

SHA256
29afc82a62270c6321521ded66d83b078417ddebde0427e3ca5770b2b9c10652

SHA512
815c01ff54e2749e22a6f6eedeb997f01cfc03f9904e1b1fed1ee5b43375804a9283e7f1fb41c240ff09ec50cb3a43b6402d936451d2fc0ab5d0274659ecf5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22768.exe

Filesize
468KB

MD5
a000b2a331ad8f8897785a33201bc76d

SHA1
fc86e0198901697411893b4599dfe1e2c8cb5c34

SHA256
260b96de04e5ee39109cb6bc88619524fa050897b606bf3cfd54ae882b5ed725

SHA512
a706e8da5782409385b583f31996679b0094d24d4833bf5abf055d409e570e69092b8b05f50c83b9affef9a1027fa796eafae38d6c09bed3d0f8234188aaccea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34061.exe

Filesize
468KB

MD5
d80d3a7ae42f271756c65e097a10d15e

SHA1
aed267bd99fc46ad73ee5e38a2c914808994104e

SHA256
e02eb0e6d903453a113e70615f177d264ac2bf1954027f17f9d645a5fd2e739e

SHA512
42f744e2baef562307bada4ed6e8da1afea471d6a98473d5e3616eb2ba508953d28353ced36cb087b711ddb2a693751a03bc5af6a4ea640838f8005d7699201d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe

Filesize
468KB

MD5
bd92558807d2d168d82add567ebecadc

SHA1
12195177c2c9425771339a91cb1d4f19be7fcb28

SHA256
8539799ffa23afe93fdc23f6c497d9b274a2e01273585c3d852f321ba64bae02

SHA512
2e6f7ef438dc6495bfeb2623f13cc3858bf8f864438860dfa00e75068287219753e8fa16bcf5f79f9961790e3e920c6427211ef55902f8937397f175b382eca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe

Filesize
468KB

MD5
6d014e120620a4f1f6ec121e48581153

SHA1
98bed81ac1eca43e4b51db627b3567f07a5a3c83

SHA256
32b28be5cb99cd57f5eb858e6b443251470d49dd2eb192fabbd41bb1473a2394

SHA512
839dce635521a93b6e334635a9907033751306058935ef72e50d33cb9471e52ba71e3000678109b1b5a3e5b38ae7a1676ee7e2c00530e6599b83ac5db8b31355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-428.exe

Filesize
468KB

MD5
fee8e61323fa9d6d43afd5e58ed0151e

SHA1
11c5735dd0af16931627232e5fdf1a7d422dd3fe

SHA256
5c15ac9a9a941be0ff443a428f0f6fe08c51f5b92d799fd7707158a8329a5f4b

SHA512
dca5c055d114f5dd0fd9a235bdec68dbd324d4313ec69f6417ab8ea0e71c9d57e276fed14e6dd0d18dcf85db28f9dd5fe7a19205fa98e54c3385b9fa5051ba81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45759.exe

Filesize
468KB

MD5
191f1c333599d41ea2b6329c552bb09b

SHA1
93cbea7a2d2cfcd9d89fe3e1113a2ba021dea8d8

SHA256
fd6a9913a712c99687837f1f2b4ac69d062c75935f679c1b3814ff1248829c50

SHA512
dbb19f4c184ef1746b3f2d1d7d5d25551e564c06a7a389ff412140b69d3ac9b20d9062858aeb69d8c153a20f9147ba9506e19ac13e68d2dba5df103743c855af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe

Filesize
468KB

MD5
f20cf9b92936ba371ba3cccb11053ade

SHA1
707af458df7c3c832fbb6dcf56694c96a5936e7b

SHA256
42e97b9a75544438ee31cb9aaf1ecce34bc2a8bc3f4aa370ac82fc5b6b84adae

SHA512
38992362483fe1a79ad78a33f3325972564f94899f53ba604f450bef7b0bbfea439976f7d5f80f96821322fd0febc91f24f0a8dfac214f3b1b347f5d068cccd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe

Filesize
468KB

MD5
e25e066c424ef01f93b28ce387bcfbe3

SHA1
3c75d7f111e6ab35a0c50f063d99dcd25333ca8a

SHA256
828f7a3e5f2c173e9aebe1fec9adf8fc01948c0c6f8aab280ff3c34c95dc99e8

SHA512
d33984afbf9f2105cf661e060a885a6b7cdf72e1094484b34f5cc889d8007794a1ce0b0099838a554a980026767bb55c16e0fc216ed6309d9e7aebb6ff02f0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe

Filesize
468KB

MD5
0d2f82c8e21107460bd1bf8605a2dcba

SHA1
263b5fcb824bccaa3c64b2034fc6c548e5d3e402

SHA256
baa678b39e66df9b59c471ac9cc72f755811c4f63325fb6ee913f3b62f6efaaa

SHA512
8b15bc67b8b6f5affaea43460b93f58b6668e5400de948f92208069857f8a5efc957ab2c5b7b8f6c591a2f369cc14c07c1c1bb5e32e0cf3c932b5af99f12d01e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52230.exe

Filesize
468KB

MD5
a3e616646b817c8fa13509f0e25dc3f8

SHA1
bc5bb040ef05351501e09006ad1e2a5997613b35

SHA256
02e85996fe56260bb3ae23669a0bfb28e455667483786d41814ca1b5be5d9b7e

SHA512
8c323e9f352cc94a8894482da280b16cbdf9cbb3bbd9596d345c65ef549b1ad767e6dff01c30d941481bb52916054b269535adae40cea8e88a814e28f71a2326

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe

Filesize
468KB

MD5
0252814800cd4b996971b91356188e3c

SHA1
f491e24c3c6f5a79a86ac692087c752dc2425c1a

SHA256
57e680ed2a56385b38d409edc7e105f783da03047d37a7f5046b9abb9304f26b

SHA512
b54f1bc0dd19c3d04b81c492496752e2a01ac4cd3e7d2d44d3d44f306ced4a006aaa44b9d7198f72091c22a25c053b7064e1d3dc545bfefc8f150a3e6c6909b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe

Filesize
468KB

MD5
727e5fe44b2015e1ac47ba0f3d4b9c88

SHA1
7c0870e388edf983485758c8895049a56ec0fbf5

SHA256
0c3c47c166cc090a5bdfe251cb586abb10143f222328887e5d9df9828cd58162

SHA512
700fc3ba4cc867e776fee5d28ea8e5427917caca64226e0ff19ccfd047fb27317bccb64fce63f3136fad924f774f027fe70d49cc2e1136d229c971e60e0b4a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe

Filesize
468KB

MD5
928257a85e282054e5da95a37dd75e98

SHA1
677ab459afad8621082f7a7f3207a3b79f054189

SHA256
1637a805df4d590d1821447d9bbb3df068b9c7f6683b15df536959a98a01062e

SHA512
48a6feddbea6e9cdcfa932d17aa992de98cfe4ca2ffe51668490f103bbf6a4e93efb3b39e9a8e87c786cde58b944f68589b9cef2263f8cd7f42f881c35d4250a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe

Filesize
468KB

MD5
179642b04e9e9d8181681e0ec385f8f6

SHA1
61a154ce1a636f93f469702e6d46f169ef93a5a1

SHA256
3aad184b65c80f4af38adeb9757d9a1a3b4ffef2374e7bb4603ae514c5e347b8

SHA512
d0bff915bb4310879da82c7735c2418f31f0bb9e4be50f2c12275a362dbb40df3d0535b73af6a3406f7edf80064191809c81c6cd3d65b1068fcdcd2abf73fd26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62298.exe

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe

Filesize
468KB

MD5
72b22867ad0123d3a1711f33b587a087

SHA1
937f9ce89d8b11e34969d9b965f206e076efc965

SHA256
82181cef11da6d49ea9e5607054cfc4f6ad210ba1fb79ad6ce3e7ced65a525c2

SHA512
fb8408fabef49c4e741e05642d9ce8e61f195959006e8396efa32c6ef9b8aba6698042c9445fd540124e3eb48060a7928443fb0992f85a3c5fd5a7e0930d3480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe

Filesize
468KB

MD5
bd9c5a890dfe8df6931288132216efd0

SHA1
b027af742541664880331610e4fffbf5f08c5e9d

SHA256
f4079e071ffb1eff2fa677e53359acfc6fc8e7fa305c085a3f5a7257f1504f87

SHA512
ef9506cb53bd26c8471d3cc3422f368dd0823bde31b98ecc0a23b50f6ae2604c251912de592084d94b2cfc3fc1dce61a447ddc393f986ad6b6ebf6888e1fea81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe

Filesize
468KB

MD5
9ce0b78773801ba51aeda2b252ebbcdd

SHA1
7ea6ed6382b213148e3ab7b357941cb17bc0d097

SHA256
f8ff338ebfbe13456d6e8fab24eecb2a1be2c956fb2dc883012b4210c5186ba8

SHA512
175b01a19ccf2b7e7893018482472eee2eb85efeeba50cc2c208903fd52297945337f1c4005ac65fc7dd27fa04b261a06490a92fd757d88783490180a8ed0ca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe

Filesize
468KB

MD5
9e7a6c446e7b85ba87e3153c5ed269d6

SHA1
5cb6b3d02e65f8de1e6f5359da0c3d674dab6ae7

SHA256
fb8b11cdb7bc6ad45131c37997a7c7081b78b15646ff7b6515223cdd88b0c6c1

SHA512
e025dbea9ecaad2fc6a15adf606eb32627c1978760bcf2b15d9ea0becc32ca5f8c926c26d8a4686286d19ea8f912ce0bd431fa89d287160c7a29769fdf632fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe

Filesize
468KB

MD5
d7606bb490ea00a2b2ff34755d21b288

SHA1
dc3af7f26a8f652b2847a4a101f13cec7f62d8d3

SHA256
97a951fa5e63b388ab73ba10ec36bce30fcef08008985b19b418be6cb3951e52

SHA512
5679e4d8129108b23480b2ac54620fd8f2626b3d70edf7bf99cb0d52d428c282ab16d1fbfbaeb4bbc35dccf29d5b937341672581ded2fc50ffdd1153c37ea681

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe

Filesize
468KB

MD5
31ed0950926ddc80d9996960cb3de7ac

SHA1
ad8863e8ba318ed8740e5761e13399d5b76074cf

SHA256
f0ca312936cacfea21e74de62b24c2f6070635883ef3baa9ca83ca97bcece14d

SHA512
783111d5070b94cdb629fd282b803e5b48163757161d2aa32a35ed3a4b55fc4f07a43a32d0fa0c556becb7cc29d4e7800f8bd54826fd2738d432fd3cd5281774

Download Submit
memory/1792-2818-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-2847-0x00007FFC2E430000-0x00007FFC2E625000-memory.dmp

Filesize
2.0MB

Download
memory/8728-2853-0x0000000075770000-0x000000007580F000-memory.dmp

Filesize
636KB

Download
memory/16012-2855-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17332-2889-0x00007FFC2E430000-0x00007FFC2E625000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads