3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6

Analysis

max time kernel
113s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe
Size

468KB
MD5

6d6b033813293379b535ae4dc55db600
SHA1

e450dc001516cdf1c1b70c45ad08a4bb95a87642
SHA256

3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6
SHA512

2f6ea16f73dde8c889521eff9cf81a9c3bbba714c892c72e2ff582a1c44bd9bbb313c1127ae2ad345a74e19473259696b2db10d52f62180504e74869b9662519
SSDEEP

3072:4belogx/If57tbYEPzcfmbfD/i2DnsIH9lmyeQVsxM5AkkhQuxul7:4b4ozB7t7P4fmbf4aezM558Qux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4156	Unicorn-53053.exe
2824	Unicorn-55876.exe
1704	Unicorn-10204.exe
3596	Unicorn-49265.exe
2644	Unicorn-63555.exe
1960	Unicorn-64.exe
5104	Unicorn-57988.exe
1876	Unicorn-18705.exe
2416	Unicorn-27427.exe
3352	Unicorn-15929.exe
4024	Unicorn-16483.exe
3920	Unicorn-36349.exe
3796	Unicorn-36349.exe
3364	Unicorn-38387.exe
4056	Unicorn-44252.exe
4916	Unicorn-41393.exe
3120	Unicorn-31231.exe
116	Unicorn-8018.exe
2972	Unicorn-14148.exe
1712	Unicorn-46437.exe
3972	Unicorn-42907.exe
2248	Unicorn-13572.exe
4724	Unicorn-21741.exe
664	Unicorn-17657.exe
3188	Unicorn-5959.exe
4248	Unicorn-29146.exe
3248	Unicorn-37812.exe
2332	Unicorn-40115.exe
4148	Unicorn-24429.exe
1760	Unicorn-479.exe
1528	Unicorn-36681.exe
3644	Unicorn-38719.exe
1840	Unicorn-33151.exe
5108	Unicorn-48668.exe
4440	Unicorn-44849.exe
3600	Unicorn-21998.exe
1756	Unicorn-40381.exe
4476	Unicorn-4179.exe
2860	Unicorn-58253.exe
1244	Unicorn-45617.exe
1092	Unicorn-39487.exe
4192	Unicorn-38003.exe
2216	Unicorn-10706.exe
948	Unicorn-16837.exe
1316	Unicorn-25005.exe
2508	Unicorn-32410.exe
4380	Unicorn-49509.exe
4584	Unicorn-57677.exe
1224	Unicorn-53593.exe
680	Unicorn-37811.exe
1592	Unicorn-58232.exe
8	Unicorn-32716.exe
2708	Unicorn-52632.exe
5012	Unicorn-24813.exe
3472	Unicorn-13115.exe
1716	Unicorn-19083.exe
4736	Unicorn-2000.exe
4616	Unicorn-14807.exe
508	Unicorn-63261.exe
588	Unicorn-7930.exe
2600	Unicorn-12014.exe
1260	Unicorn-7236.exe
4968	Unicorn-11320.exe
4628	Unicorn-3152.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5320	6036	WerFault.exe	209
18300	4812	WerFault.exe
17784	2368	WerFault.exe	980
3260	17548	WerFault.exe	931
17764	15492	WerFault.exe	798

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4179.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16748	dwm.exe
Token: SeChangeNotifyPrivilege	16748	dwm.exe
Token: 33	16748	dwm.exe
Token: SeIncBasePriorityPrivilege	16748	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe
4156	Unicorn-53053.exe
2824	Unicorn-55876.exe
1704	Unicorn-10204.exe
3596	Unicorn-49265.exe
5104	Unicorn-57988.exe
1960	Unicorn-64.exe
2644	Unicorn-63555.exe
1876	Unicorn-18705.exe
2416	Unicorn-27427.exe
3352	Unicorn-15929.exe
3796	Unicorn-36349.exe
4024	Unicorn-16483.exe
3364	Unicorn-38387.exe
3920	Unicorn-36349.exe
4056	Unicorn-44252.exe
4916	Unicorn-41393.exe
3120	Unicorn-31231.exe
2972	Unicorn-14148.exe
116	Unicorn-8018.exe
1712	Unicorn-46437.exe
3972	Unicorn-42907.exe
4724	Unicorn-21741.exe
2248	Unicorn-13572.exe
4248	Unicorn-29146.exe
3188	Unicorn-5959.exe
3248	Unicorn-37812.exe
664	Unicorn-17657.exe
2332	Unicorn-40115.exe
4148	Unicorn-24429.exe
5108	Unicorn-48668.exe
3644	Unicorn-38719.exe
1760	Unicorn-479.exe
4440	Unicorn-44849.exe
1840	Unicorn-33151.exe
1528	Unicorn-36681.exe
1756	Unicorn-40381.exe
3600	Unicorn-21998.exe
4476	Unicorn-4179.exe
2860	Unicorn-58253.exe
1092	Unicorn-39487.exe
1244	Unicorn-45617.exe
4192	Unicorn-38003.exe
1316	Unicorn-25005.exe
948	Unicorn-16837.exe
2216	Unicorn-10706.exe
2508	Unicorn-32410.exe
4584	Unicorn-57677.exe
1224	Unicorn-53593.exe
680	Unicorn-37811.exe
4380	Unicorn-49509.exe
1592	Unicorn-58232.exe
2708	Unicorn-52632.exe
5012	Unicorn-24813.exe
3472	Unicorn-13115.exe
8	Unicorn-32716.exe
1716	Unicorn-19083.exe
4736	Unicorn-2000.exe
4616	Unicorn-14807.exe
508	Unicorn-63261.exe
588	Unicorn-7930.exe
2600	Unicorn-12014.exe
1260	Unicorn-7236.exe
4968	Unicorn-11320.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 4156	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	86
PID 100 wrote to memory of 4156	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	86
PID 100 wrote to memory of 4156	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	86
PID 100 wrote to memory of 2824	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	87
PID 100 wrote to memory of 2824	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	87
PID 100 wrote to memory of 2824	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	87
PID 4156 wrote to memory of 1704	4156	Unicorn-53053.exe	88
PID 4156 wrote to memory of 1704	4156	Unicorn-53053.exe	88
PID 4156 wrote to memory of 1704	4156	Unicorn-53053.exe	88
PID 2824 wrote to memory of 3596	2824	Unicorn-55876.exe	89
PID 2824 wrote to memory of 3596	2824	Unicorn-55876.exe	89
PID 2824 wrote to memory of 3596	2824	Unicorn-55876.exe	89
PID 100 wrote to memory of 2644	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	90
PID 100 wrote to memory of 2644	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	90
PID 100 wrote to memory of 2644	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	90
PID 1704 wrote to memory of 1960	1704	Unicorn-10204.exe	91
PID 1704 wrote to memory of 1960	1704	Unicorn-10204.exe	91
PID 1704 wrote to memory of 1960	1704	Unicorn-10204.exe	91
PID 4156 wrote to memory of 5104	4156	Unicorn-53053.exe	92
PID 4156 wrote to memory of 5104	4156	Unicorn-53053.exe	92
PID 4156 wrote to memory of 5104	4156	Unicorn-53053.exe	92
PID 3596 wrote to memory of 1876	3596	Unicorn-49265.exe	93
PID 3596 wrote to memory of 1876	3596	Unicorn-49265.exe	93
PID 3596 wrote to memory of 1876	3596	Unicorn-49265.exe	93
PID 2824 wrote to memory of 2416	2824	Unicorn-55876.exe	94
PID 2824 wrote to memory of 2416	2824	Unicorn-55876.exe	94
PID 2824 wrote to memory of 2416	2824	Unicorn-55876.exe	94
PID 1960 wrote to memory of 3352	1960	Unicorn-64.exe	95
PID 1960 wrote to memory of 3352	1960	Unicorn-64.exe	95
PID 1960 wrote to memory of 3352	1960	Unicorn-64.exe	95
PID 1704 wrote to memory of 4024	1704	Unicorn-10204.exe	96
PID 1704 wrote to memory of 4024	1704	Unicorn-10204.exe	96
PID 1704 wrote to memory of 4024	1704	Unicorn-10204.exe	96
PID 5104 wrote to memory of 3920	5104	Unicorn-57988.exe	98
PID 5104 wrote to memory of 3920	5104	Unicorn-57988.exe	98
PID 5104 wrote to memory of 3920	5104	Unicorn-57988.exe	98
PID 2644 wrote to memory of 3796	2644	Unicorn-63555.exe	97
PID 2644 wrote to memory of 3796	2644	Unicorn-63555.exe	97
PID 2644 wrote to memory of 3796	2644	Unicorn-63555.exe	97
PID 4156 wrote to memory of 3364	4156	Unicorn-53053.exe	100
PID 4156 wrote to memory of 3364	4156	Unicorn-53053.exe	100
PID 4156 wrote to memory of 3364	4156	Unicorn-53053.exe	100
PID 100 wrote to memory of 4056	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	99
PID 100 wrote to memory of 4056	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	99
PID 100 wrote to memory of 4056	100	3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe	99
PID 1876 wrote to memory of 4916	1876	Unicorn-18705.exe	101
PID 1876 wrote to memory of 4916	1876	Unicorn-18705.exe	101
PID 1876 wrote to memory of 4916	1876	Unicorn-18705.exe	101
PID 3596 wrote to memory of 3120	3596	Unicorn-49265.exe	102
PID 3596 wrote to memory of 3120	3596	Unicorn-49265.exe	102
PID 3596 wrote to memory of 3120	3596	Unicorn-49265.exe	102
PID 2824 wrote to memory of 116	2824	Unicorn-55876.exe	103
PID 2824 wrote to memory of 116	2824	Unicorn-55876.exe	103
PID 2824 wrote to memory of 116	2824	Unicorn-55876.exe	103
PID 2416 wrote to memory of 2972	2416	Unicorn-27427.exe	104
PID 2416 wrote to memory of 2972	2416	Unicorn-27427.exe	104
PID 2416 wrote to memory of 2972	2416	Unicorn-27427.exe	104
PID 3352 wrote to memory of 1712	3352	Unicorn-15929.exe	105
PID 3352 wrote to memory of 1712	3352	Unicorn-15929.exe	105
PID 3352 wrote to memory of 1712	3352	Unicorn-15929.exe	105
PID 1960 wrote to memory of 3972	1960	Unicorn-64.exe	106
PID 1960 wrote to memory of 3972	1960	Unicorn-64.exe	106
PID 1960 wrote to memory of 3972	1960	Unicorn-64.exe	106
PID 3920 wrote to memory of 2248	3920	Unicorn-36349.exe	107

C:\Users\Admin\AppData\Local\Temp\3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe
"C:\Users\Admin\AppData\Local\Temp\3188dff01e72910218d9de02b2c27a7d77d3d8705db758d59c817e7e44b349e6N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        8⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        9⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        10⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        10⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        10⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        10⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        9⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        9⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
        9⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        9⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        10⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        10⤵
        
        PID:17428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        9⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
        9⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        9⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        8⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31336.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24453.exe
        8⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        8⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        8⤵
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        7⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38809.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        10⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        10⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57732.exe
        9⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        9⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27303.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
        9⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        8⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        8⤵
        
        PID:18324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        9⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        8⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe
        8⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        7⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        7⤵
        
        PID:17472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        6⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe
        6⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31549.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        9⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        10⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        11⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        10⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        9⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        8⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
        8⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        8⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        8⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        7⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28019.exe
        6⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        9⤵
        
        PID:15492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15492 -s 460
        10⤵
        Program crash
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        7⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        7⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2334.exe
        8⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60322.exe
        8⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
        7⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        8⤵
        
        PID:18288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        7⤵
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        6⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        5⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        7⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        6⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19159.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
        7⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
        7⤵
        
        PID:17820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        6⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        7⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43559.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exe
        5⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        5⤵
        
        PID:4812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 248
        6⤵
        Program crash
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        8⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        8⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
        7⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
        7⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        7⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        6⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        7⤵
        
        PID:17588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54120.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3654.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51084.exe
        5⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        5⤵
        
        PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
        5⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        7⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        7⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        7⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        6⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
        7⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        6⤵
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        6⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4561.exe
        5⤵
        
        PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        6⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        5⤵
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61200.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        5⤵
        
        PID:18060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45077.exe
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
      4⤵
      PID:14444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        9⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        9⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        8⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        8⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        8⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        7⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
        6⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        7⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        8⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        7⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        7⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        6⤵
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        6⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52709.exe
        8⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52812.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51011.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        7⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38247.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        7⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
        6⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        6⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        5⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        6⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 216
        7⤵
        Program crash
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        6⤵
        
        PID:11724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        6⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        6⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        6⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
      4⤵
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        7⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        5⤵
        
        PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
      4⤵
      PID:14020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35892.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        5⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        7⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        7⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        6⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        7⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        6⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42843.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        6⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        5⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        5⤵
        
        PID:17980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
      4⤵
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        6⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        5⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        6⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        5⤵
        
        PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
      4⤵
      PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        5⤵
        
        PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
      4⤵
      PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30625.exe
      4⤵
      PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
      4⤵
      PID:17500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        5⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        7⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        5⤵
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        6⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        5⤵
        
        PID:17668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
      4⤵
      PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
      4⤵
      PID:12692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
      4⤵
      PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51694.exe
      4⤵
      PID:8368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3728.exe
      4⤵
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38759.exe
        6⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        5⤵
        
        PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63201.exe
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
      4⤵
      PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      4⤵
      PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
      4⤵
      PID:17844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
    3⤵
    PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5324.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        5⤵
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
      4⤵
      PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
      4⤵
      PID:12944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
    3⤵
    PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
      4⤵
      PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        5⤵
        
        PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
      4⤵
      PID:13928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
      4⤵
      PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
    3⤵
    PID:10108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
    3⤵
    PID:14604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
    3⤵
    PID:18240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        9⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
        10⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
        10⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14576.exe
        10⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        9⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        9⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe
        9⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        8⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        8⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        9⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        9⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        8⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        7⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        8⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        8⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        7⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        9⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        9⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        8⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        8⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        8⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1438.exe
        8⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23416.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        9⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        9⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53772.exe
        9⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        8⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        8⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24371.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        7⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        7⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57847.exe
        9⤵
        
        PID:18084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
        8⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        7⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11735.exe
        6⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        7⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        6⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1438.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        6⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        5⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23685.exe
        6⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        6⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        5⤵
        
        PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9348.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        9⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        10⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        9⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        9⤵
        
        PID:17888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        8⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        8⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        7⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        8⤵
        
        PID:17548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17548 -s 76
        9⤵
        Program crash
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        7⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        7⤵
        
        PID:17812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        6⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3560.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        7⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        6⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        5⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
        8⤵
        
        PID:18300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        7⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        7⤵
        
        PID:16144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
        6⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exe
        5⤵
        
        PID:18220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33854.exe
        7⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        6⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        5⤵
        
        PID:14708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27392.exe
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        6⤵
        
        PID:17080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        6⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        5⤵
        
        PID:17436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52792.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        5⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7103.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
      4⤵
      PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55445.exe
      4⤵
      PID:17644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44849.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11320.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        9⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24453.exe
        8⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        8⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        8⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        7⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
        7⤵
        
        PID:18408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        7⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        6⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        7⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        5⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60957.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        8⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        8⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57591.exe
        7⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        7⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        6⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        6⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        5⤵
        Executes dropped EXE
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        8⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
        8⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        7⤵
        
        PID:18028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        6⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        7⤵
        
        PID:18000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        6⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        7⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
        6⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12074.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        5⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        5⤵
        
        PID:17496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
      4⤵
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14392.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60957.exe
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        7⤵
        
        PID:18356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        6⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        6⤵
        
        PID:17508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        6⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        6⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
        5⤵
        
        PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        5⤵
        
        PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
      4⤵
      PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        5⤵
        
        PID:17980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
      4⤵
      PID:13576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30795.exe
        8⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62049.exe
        7⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        6⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40286.exe
        6⤵
        
        PID:17564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        6⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41889.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        6⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        6⤵
        
        PID:18020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        5⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        5⤵
        
        PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
      4⤵
      PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
      4⤵
      PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
      4⤵
      PID:12964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11320.exe
      4⤵
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53012.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        6⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        5⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        5⤵
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        6⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        5⤵
        
        PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
      4⤵
      PID:8892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
      4⤵
      PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe
      4⤵
      PID:17880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    3⤵
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        5⤵
        
        PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
      4⤵
      PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
      4⤵
      PID:15088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
    3⤵
    PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
      4⤵
      PID:14496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
    3⤵
    PID:10052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
    3⤵
    PID:14660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        6⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41933.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        7⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        6⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        7⤵
        
        PID:16040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        6⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44889.exe
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        5⤵
        
        PID:12336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        5⤵
        
        PID:17000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        5⤵
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        5⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54141.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
        8⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        6⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22896.exe
        5⤵
        
        PID:14692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        6⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        6⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
      4⤵
      PID:13960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      4⤵
      PID:17864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        5⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29881.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        7⤵
        
        PID:17412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        6⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        7⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        6⤵
        
        PID:18420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18374.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55760.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        5⤵
        
        PID:18040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
      4⤵
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50441.exe
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        6⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
        5⤵
        
        PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        5⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        5⤵
        
        PID:17684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7903.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
      4⤵
      PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32708.exe
      4⤵
      PID:16560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
      4⤵
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        5⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        5⤵
        
        PID:18372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        5⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        5⤵
        
        PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47347.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
      4⤵
      PID:15100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
        5⤵
        
        PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
      4⤵
      PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
      4⤵
      PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
      4⤵
      PID:13468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
      4⤵
      PID:16132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
    3⤵
    PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24453.exe
      4⤵
      PID:12192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
      4⤵
      PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
    3⤵
    PID:10404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
    3⤵
    PID:14740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
        5⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
        7⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        7⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
        6⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        6⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        5⤵
        
        PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
      4⤵
      PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        6⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
        5⤵
        
        PID:17628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
        5⤵
        
        PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
      4⤵
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        6⤵
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        6⤵
        
        PID:18048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
      4⤵
      PID:11640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
    3⤵
    PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        5⤵
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      4⤵
      PID:14484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
      4⤵
      PID:14344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
    3⤵
    PID:16376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21062.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        5⤵
        
        PID:16212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
      4⤵
      PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
      4⤵
      PID:1620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53100.exe
    3⤵
    PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
      4⤵
      PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        5⤵
        
        PID:16792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
      4⤵
      PID:10652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
    3⤵
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
      4⤵
      PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
      4⤵
      PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
      4⤵
      PID:2368
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 72
        5⤵
        Program crash
        
        PID:17784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
    3⤵
    PID:9960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
    3⤵
    PID:14068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
    3⤵
    PID:2120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        5⤵
        
        PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
      4⤵
      PID:16292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
      4⤵
      PID:17868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
    3⤵
    PID:11608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
    3⤵
    PID:16776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
    3⤵
    PID:1020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
  2⤵
  PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
    3⤵
    PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
      4⤵
      PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
      4⤵
      PID:17772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
    3⤵
    PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
    3⤵
    PID:14424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
  2⤵
  PID:7596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
    3⤵
    PID:10504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
    3⤵
    PID:16336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
  2⤵
  PID:16232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
  2⤵
  PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6036 -ip 6036
1⤵
PID:6024

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:16748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 16748 -s 388
  2⤵
  PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 17576 -ip 17576
1⤵
PID:18308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2368 -ip 2368
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 17548 -ip 17548
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 15492 -ip 15492
1⤵
PID:4392

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17588

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17880

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:17648

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:18248

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\eab13d0a485741c1b1176fabd4617a7c /t 3912 /p 3852
1⤵
PID:5776

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\ed405759f4204204a59fde6988da35cd /t 3896 /p 4708
1⤵
PID:1644

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:18024

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe

Filesize
468KB

MD5
cf77593b1fb47853690fc10edb9761af

SHA1
4d547af529ef9cd846bfb62b1a6004fcadc00e9e

SHA256
d4149d0c7f4d6d449a2fe013caa3f28c1a4988aeb1c85cfede023cf4d18a3b83

SHA512
4ca06e48a40b4f539afd150a3038821355dd89c0d741ef78da74ef5ce660541b868ebc237990ee3bc03842c05a2bb569a8776131bd0d303021d16a39ece3188f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11735.exe

Filesize
468KB

MD5
be9747dab32eee3e91a7fa657e59f7c2

SHA1
6cf536a1def9afffc066cc35b79629eb863e397f

SHA256
7bbc97e59e022975e378041adfe48646b7b44b059024fdf7bf8d77e9a2c5f9f0

SHA512
efbdef16af0fbd324e6062614c64c71b45813e63a3d539dd487b1f6379f30c6aca3773b99be923fa1960ec1673a1e9286496c49a7093d212ad15baea26f598ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe

Filesize
468KB

MD5
e8a8a8b04d31d44d1e2177a0f18b0d0b

SHA1
a86331a774ba404400884aa7944da28f83ce594a

SHA256
b0c0359b75e33234f68c7d4e64f781d02efa0e6eb748d0e904ed1e32ff19f90b

SHA512
69bcc83ec2bf76a3c4a89f73c21cbde5a23ac8b0aa3be4968ea74dde289d356d7f9c9b3d8ef0decd0873c60b05eb3d9da35074eae1a895e3556b861c349d6761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe

Filesize
468KB

MD5
7b8fa75fe6b69792746ba6b0c3be0360

SHA1
1d41b9b71accab9285389646bccfb58470cd5dcb

SHA256
aa0ea4703bbc587a342dfae300b56dd0478d901446a65335385b0c610c75532e

SHA512
3c730fb15bbc8bed947764f58f008f90a2ee16a49af680659d5b222e46cb7e76e44ba3de63d0f7b5cefd046e0640d3f2c20732abed6a1cabfe70fffde8a65f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe

Filesize
468KB

MD5
2cc8e6cb4ab5edd639bf1fe2adbb8107

SHA1
6bfe3b9c252f1c450d5f0fd12fc446082b7ffccb

SHA256
30a08dac065989f8903fdd2ad826a15776a875f76ac7f382c654a416f4dc762e

SHA512
9d5174e0f69d1401a25290a420f3581c4aa1fedc90a50f795e2eb31e6dded6a4371fbd942046a23c291c7b69ef1086b7eaa921d0caab4291514dd1d747bc381c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe

Filesize
468KB

MD5
db986c97eaadf98cc0e2e9e2b3bcab3e

SHA1
3dae4dcb6629a8489519ba486f8f1a70225d9328

SHA256
9d14a2c67215d92fa027bbaf5805f945c03d5bf6239fec8fd0f1f2ea091f6c3d

SHA512
cd443d0d423a0b6e9b8ed0addc0a701706077f2f558a0c97e96561f9c977428bd9eec730932dee2d4fff2c96777a7f2f86818e418eff50c8e22eba4ebe78cb89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe

Filesize
468KB

MD5
e18ad30ac75707ee184d398593b48846

SHA1
c5f83d2c732498e2bf03e3456a301482f44db8c3

SHA256
c630636a7a1a337fd8b549d4fd22e2e3b1fd3ed04fca9459a46cd8ad3e7573b3

SHA512
4c6ff1e5a42d9ff5ad544fa94d52a47fbcbbffc5fbec9117650a5e96e75465bddccf4cd5f02f3627012bd314364cb22281971d0334f0f59e737f55aa132a857c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe

Filesize
468KB

MD5
acc0eda0c48e929eb4e512fe27677356

SHA1
2125598a5fa86d0567d6bf891f4c0a7b1af6b927

SHA256
f426ef0abac0f08159d73d859778e76d286f50623dc4f8b7b37f87d301d216a2

SHA512
48b05234473e070702780ad7430d98cdfbc50c162dd79eb94227672174c26f689e37392366a62ee21d23cbb2c6296ed67346e8fb135bcb7d8d893e3d8335fed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe

Filesize
468KB

MD5
91e96659c35bb46221b62a84ebd61110

SHA1
9f3cd1b831f230d41be3f317a3610c1fff060324

SHA256
d35c732eed32cb62a2a3371196a98d98f82d0ce9d9978ef7ed32acc87c84ad6b

SHA512
852f9896002ac49cb087e5d95be163184017a4ea2f9140e9869f40759a06753d851c3fe19039284a5dbe9dd2991c755ee08d164bc14594099cb7ee5793fac9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe

Filesize
468KB

MD5
d7264506416b59558b45a122fff62780

SHA1
e865962d5a9b457921acd45755bacdb39c096c4e

SHA256
bdebac47a2abd5d71520fb4e900567f9bc45151b4f4c11138f0dfb55665d818d

SHA512
300702a399d5b8074b4453add1d53b9dbfc140e56c7bf578d1b165370d3575673a79ea8b0aff64ef8390d83627ad97a911ae7af95fee4697c2bbfec4b4d7af49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe

Filesize
468KB

MD5
2dcc9ea703003669dadd06906454a2f1

SHA1
dc170e280fdef3333fe312853d1817c4ec7c3217

SHA256
9ce39d0e403e6699d03f7bb673ae69fc46b425bdfe2ac7c20f63a3c7d2af2d0c

SHA512
1b0e1c88058cd11160a09af4e04324a63cd223299e7b8ae4d8f11c9cf0812699a479690e5adfc9fad3d25316b2b24216e5997f0574c32d119d295c8b6f3688b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe

Filesize
468KB

MD5
f8af303aa3331eed8fc0630477fd04fb

SHA1
10c2adf14e13430469d73eb31bc09cced97835e9

SHA256
eeac42803d06586c987d9275414ee13bc28fc49082ab0a0750e0effe2e757c69

SHA512
6cf853a27e9bcc414cb5395be7f62d866db0c48620ecfcc827db865ea41d585dfa38927de088e73299f0cba8cfef610d5ce38549f4c107b0c1aa3bf263198508

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe

Filesize
468KB

MD5
453ab2f36b044852dc4f4be932305613

SHA1
d96880b4590597ce3ebba25a5dbde40f658186fa

SHA256
d3f54c1b76811f15375742c0f96099715e2ff50179aaaeccc7a27aed5cbad66b

SHA512
ca4820fee86a173b6d57afbe8132ccbc394b553992558a076a1bdee51e20c5649f23a1b054d666f8103e93f1d0f76c598c87dba9be73bac124245c5b6908873d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe

Filesize
468KB

MD5
8f26dc60c89820379919bc286c13d998

SHA1
f878d27da8ae57c027d9696b6b12ec35eb537028

SHA256
13af238f894bf89fb72058609b41c9e8d3dae6766a2d7b3a10b0b6a5cbcd43af

SHA512
fbdd0f6fcc5503a54099a1acab3de44d62baa453b70668de74aca9bfb791bb5419e7a2a31a0fdf735abc743666ee8f023e4cf5fe1f8e937e6d2892574da4b8d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe

Filesize
468KB

MD5
982b885f271933ae97a8b82aadb14d57

SHA1
ab74daf8ab1606fe879337f0a6d96c8766ed8b0a

SHA256
4f4052d608b6c61a5380b24e8578d3762994d334479ce150ca8542d1ecd07302

SHA512
53ee48dda5a72fc4b39f5af21a1499258dc66692c1b6a37f0802ba19542d9cb6e76661c79a3bf7f54c47ce86da2aef6aace7fbbaa7d8b58d2a70bb558931c9eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe

Filesize
468KB

MD5
5bf666ee453834ac466b0d0ab6bf0818

SHA1
27bb5308b2bd5ef4d00915267be03c859e9c8dcf

SHA256
9fd7879aed536e9d955b46461c1c4ded6a6907be6528822e689d5d8981e953f3

SHA512
88f4fd7f37e53984c3ab0023a5fa08de4571e8c1db183d83c5c91b59ad92ca10620739340da0154de4568342d5176638a0956b202b6e24b1208e030dd47ed684

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe

Filesize
468KB

MD5
4a0288f51c8d972cdb19f092d56fc46e

SHA1
9a0d80d1029bed4c2b7bb4582a5c2db69e5a1f46

SHA256
11011868e1287df4c91252756ff4b127bb4293f798eb05ae11dce9892304e92b

SHA512
f9e0af49f5b0cbb48f8d1c65080955c2eb8ef2cd80bd7e10924dfc34f825b233fa084402ff532aca001150a4083a7ccffc4ffad8c99cccc10ecac8af1afa4575

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe

Filesize
468KB

MD5
8d08bb40ea1115c63fe079a361e0ad57

SHA1
3eb3e644b70b4449847a206bb72c8ec937529b1a

SHA256
e295749c34e2478207e1e2a3428d225acf47f7fa0df5b6e55427981226b265ec

SHA512
ff37e87fdedf8cce1755424ac224a00649505bfc63f725f3ebda0aa9591264777695196dad35b733fd15bc9a9bb125b84e80339465731f94eed6a5ff8e94b6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe

Filesize
468KB

MD5
e0996791a7af5e0815dce59cf530dd87

SHA1
4a9f1de8d9de26b535bb8b16ac76a94c98175c95

SHA256
c66cc37cdcf2171f1a8c55099cbd1d331ba1679c923257b5c65eb21ca875bc8d

SHA512
5ac35c6ce8376b0150c6dc15b56bd9c59dcaa2b828069887aedb39db288f9d7bd463329c6f052a1373647062efb881013d0e61480297c76b7407c3d9e742efc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe

Filesize
468KB

MD5
25087ce23773872fdf67e82cda214768

SHA1
a69e8760ec36299b24ae8dc7dd18501a539e359d

SHA256
fc151075e0b8ff8f8b37bfd6774e519188e7516a4b7cb60e929706c4b18ce1a4

SHA512
f2a992d4abc11c68238e41015c9b71a12b11e730eeaf6ae16f1a819d5ddb73eae9740a8e9ab45d412b7960f04395e910bb329f28bd9f3611a4c411c391de6245

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe

Filesize
468KB

MD5
a82ff1bf9f92260da8632ee166024b07

SHA1
227b2b15a50f04561acb58019590a65f465bbd15

SHA256
9ab780ac944d4ca5eddc7088beeef7d76898a815fbd5e4325215656ad4995bfc

SHA512
a45b1b9ba168d74ca6e2992039f86c1db7ce2f708bfd07a4702ed649ac1a7e8b880bae9e4ebc6a7978c1c12f516855f261c2e56c7373629dd9c757296507993c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe

Filesize
468KB

MD5
84d5c2f3cfa4317eca723093c00d7128

SHA1
7f62fe0df13ad17839c6a0cadeed1f3c60af1551

SHA256
154dcfb1de16b7044669a233903f616c2001f6e7180fdb1753519d138a2d5266

SHA512
a732e593682106447062db1a035e1a5cf38fa119bcec49ce999dcc7d536188f3513b5e47a0ded2a50fbbba6107b1904d7c86da020b8c0d9fa09b467ab68957d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe

Filesize
468KB

MD5
ea1a19b956de1a30689bce0ddf0e628d

SHA1
ff9d4b7e585177a8da9ef0001c3b612b1dcef1a1

SHA256
62361b4d9b82bfe2645a5bdb3975d7750a214cc083fc0eb5060d00b09475de3a

SHA512
004c7d69a2971350bbbfa79345533ffe638f5aa97107e5a7f28b32514e2768d80228841676dc8b7a6122581ae04792f52af8277c946443a28a6820026945c22b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe

Filesize
468KB

MD5
b582049fa01ea00c9a09783739c8a4ed

SHA1
67cb71aaaa804be8cb7e52208078909d70b277e8

SHA256
b99e2641220ea9ac614b3453a57085bc052c0e3489ddc2e59b4f5be9dc328497

SHA512
69d1a65ebbc3db068bfef53ce39ed65177ec5f30e0e3cc7387b542f134695a81d0afc19a8be823428edb50f17680d1625c1072acc17082f6fbc28c1120f78c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe

Filesize
468KB

MD5
88af09a0541bc9f12d55ce3ab1404466

SHA1
0a0204e15f6d1a54a9e123bf925aec5572747bcc

SHA256
ead657d3a7fc570c613b1397f3979fcd848d7d45668039454f1fb769ec7840ec

SHA512
73fc9f48ae5443e8a2749f56704a41e3adf6f07adaec948407f4995f63700e5dabf110421764eb13965db413a84c788571d5970af856736151605a8e2290b676

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe

Filesize
468KB

MD5
d19de274e03bf788f8a4dba0ac5ada47

SHA1
ae9a05e6f0c52a74483fbd1418dab4a2563ac027

SHA256
339210642779443043476cebf63b42f7dfcecef71ad97475b9c7a3d256d2702d

SHA512
737449a0cefe36a88f273535fe29ef2f675b7e7b1f05f0d631a6bc7b818f09fe53faebafce3c3b3db0c9b66a66e53955c82a7015e60206a09190cb1a8833f81e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe

Filesize
468KB

MD5
6bb90574e74d7fc23604f7b21f928ee3

SHA1
9fa8cefd903454b3007ba9ce12cf0e736823e948

SHA256
b0f4887fa83692087681f510a3f9392b61b01b0a21bc6617b03e418f99ca1e83

SHA512
603965464be5055214e78759006aff760959e81941cc991466cccf190ec5637ad189b5374abe72de503b39596aea6b56020a853dbc2ab72dc9800df57135f746

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe

Filesize
468KB

MD5
bbf08e98b03e6f249e1174e53e9f3ba1

SHA1
84084306df76b287562ace6c64c82f4dc27b2a2e

SHA256
7b07036fafc44ef6e2bf31550fd052e40b7a2a33cc9cf10f1ed247a7631792cd

SHA512
70b61657621dd95ef2e1d2e55c6f9bcb36257b0068cc420fb3995a13d3c000acf554a9ce185ce8c8ef1dbc60f451382d45fd84b6392b0e00067831e81304ad09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe

Filesize
468KB

MD5
94d76f432347eea6b028420635b3b436

SHA1
b75ae61cddba237041a207018fecd6fcd9f6dec0

SHA256
e1071a41cbc9c65468877689f6e870eb933fc51222da6a1878722b1a872cf3c2

SHA512
4e69a36610518122974133a6694ba54165685f641be4b19702c6a3411fed7bdc3318635832def9641e99fe49cdbbd1eacceb4483437dee12c6e725ebd22b4249

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe

Filesize
468KB

MD5
3558dfe5dcdd8a624a83d4b1642ff97f

SHA1
5c89fffd8a92f18fb150d803b0397f5538ca862e

SHA256
dc35bba49612b37f534d5c73c891e40f1c9c76f1b40ea300aee66c8c78bea978

SHA512
0dba5a77162433a8b21b98daf94b595a6fa528cf7262da80715c141852b2e09d660645fe8b8a6d25d1291109c8f8052ec642f5d2eb25851045acbd9a56ae2dc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe

Filesize
468KB

MD5
c758619cb0640db11f5e8f06ec7d33a9

SHA1
c3fa9d52171f47f19ec5832ffb1980e39b818591

SHA256
d813c1579562910fecd63f11d1fb2e5e540cbe7fa118c6a55d4dc47e0ee1a8d5

SHA512
c10ba91eb9c7250385ccd49605d17264c85bb48a1a202c8e4da2d9799d3838cdecd8d2c7a61fae8ebe27b7d8ac437d217f81322f5c2b92d6fc426bb2de9136e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe

Filesize
468KB

MD5
52a3a45bcc179b94dbc09d3861491fce

SHA1
85e47e7a1bf25c0e7ec2edad13903874769f2ab4

SHA256
71d4e0be06d463054cdf6561971cc28b46b900b1e62c4cb4125903f63975962a

SHA512
5fdfe28c680ccfb2b70344680ca5e491bb205b4c1259cdf36b0e01c0280f668603fa17d87d29e464d12969d6e1a259b73883964e584c74cf4f6022253bf77c71

Download Submit