b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba

Analysis

max time kernel
83s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe
Size

468KB
MD5

e4f31707c2484a0e96def72a8a3e0afe
SHA1

12495552dceab0b92f1679231fee70e4410b821b
SHA256

b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba
SHA512

dffa04a84f15fe0bc321002453a9a14d1c64a378b4d4b2fcc65e61f23b806e9fb1587caa3b051a17c47af268a12e44f36549932b3eed61cb02c85e630618a719
SSDEEP

3072:4belogxaIU57tbYTPzcfmbfD/n2Dns/H9Qmye1Vq7M5KkkhduxuljT:4b4oCc7t8P4fmbfrf7YM5D8duxc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2400	Unicorn-33454.exe
4488	Unicorn-27782.exe
2748	Unicorn-16084.exe
2616	Unicorn-23034.exe
4764	Unicorn-23034.exe
2916	Unicorn-57360.exe
1688	Unicorn-43624.exe
4104	Unicorn-5493.exe
2356	Unicorn-1964.exe
2912	Unicorn-1601.exe
4884	Unicorn-5685.exe
3824	Unicorn-21756.exe
3028	Unicorn-10324.exe
4556	Unicorn-15891.exe
2248	Unicorn-53661.exe
224	Unicorn-60890.exe
4020	Unicorn-65529.exe
5040	Unicorn-36194.exe
824	Unicorn-55684.exe
2420	Unicorn-16890.exe
856	Unicorn-28758.exe
2928	Unicorn-40745.exe
3268	Unicorn-21144.exe
4456	Unicorn-4616.exe
3664	Unicorn-22819.exe
852	Unicorn-24482.exe
2316	Unicorn-24482.exe
232	Unicorn-15551.exe
5108	Unicorn-24482.exe
436	Unicorn-50714.exe
4352	Unicorn-52752.exe
4812	Unicorn-59842.exe
4480	Unicorn-18810.exe
1624	Unicorn-56718.exe
3904	Unicorn-3988.exe
1488	Unicorn-65078.exe
216	Unicorn-25891.exe
3388	Unicorn-18623.exe
4600	Unicorn-48358.exe
1516	Unicorn-23662.exe
2808	Unicorn-61165.exe
4320	Unicorn-49053.exe
2008	Unicorn-8285.exe
3804	Unicorn-33174.exe
1500	Unicorn-41896.exe
2404	Unicorn-6431.exe
3624	Unicorn-7132.exe
1552	Unicorn-61186.exe
3588	Unicorn-4372.exe
3720	Unicorn-45042.exe
3732	Unicorn-45042.exe
1736	Unicorn-8093.exe
3076	Unicorn-46002.exe
1604	Unicorn-35980.exe
4780	Unicorn-16956.exe
3048	Unicorn-34496.exe
1976	Unicorn-62893.exe
2696	Unicorn-4896.exe
1860	Unicorn-54362.exe
4100	Unicorn-59001.exe
2952	Unicorn-50278.exe
4416	Unicorn-55685.exe
3472	Unicorn-42878.exe
1912	Unicorn-63661.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1188	856	WerFault.exe	120
4464	1976	WerFault.exe	158
10084	5568	WerFault.exe	202
14772	6704	WerFault.exe	284

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47414.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe
2400	Unicorn-33454.exe
4488	Unicorn-27782.exe
2748	Unicorn-16084.exe
2616	Unicorn-23034.exe
1688	Unicorn-43624.exe
2916	Unicorn-57360.exe
4764	Unicorn-23034.exe
4104	Unicorn-5493.exe
2356	Unicorn-1964.exe
2912	Unicorn-1601.exe
3824	Unicorn-21756.exe
4556	Unicorn-15891.exe
4884	Unicorn-5685.exe
3028	Unicorn-10324.exe
2248	Unicorn-53661.exe
224	Unicorn-60890.exe
4020	Unicorn-65529.exe
5040	Unicorn-36194.exe
824	Unicorn-55684.exe
2928	Unicorn-40745.exe
856	Unicorn-28758.exe
2420	Unicorn-16890.exe
3664	Unicorn-22819.exe
2316	Unicorn-24482.exe
852	Unicorn-24482.exe
3268	Unicorn-21144.exe
232	Unicorn-15551.exe
4456	Unicorn-4616.exe
5108	Unicorn-24482.exe
4352	Unicorn-52752.exe
436	Unicorn-50714.exe
4812	Unicorn-59842.exe
4480	Unicorn-18810.exe
1624	Unicorn-56718.exe
3904	Unicorn-3988.exe
1488	Unicorn-65078.exe
3388	Unicorn-18623.exe
216	Unicorn-25891.exe
2808	Unicorn-61165.exe
4600	Unicorn-48358.exe
1516	Unicorn-23662.exe
4320	Unicorn-49053.exe
2008	Unicorn-8285.exe
3804	Unicorn-33174.exe
1500	Unicorn-41896.exe
2404	Unicorn-6431.exe
3624	Unicorn-7132.exe
1552	Unicorn-61186.exe
3720	Unicorn-45042.exe
3732	Unicorn-45042.exe
3588	Unicorn-4372.exe
3076	Unicorn-46002.exe
1604	Unicorn-35980.exe
1736	Unicorn-8093.exe
1860	Unicorn-54362.exe
4780	Unicorn-16956.exe
1976	Unicorn-62893.exe
3048	Unicorn-34496.exe
2696	Unicorn-4896.exe
2952	Unicorn-50278.exe
4100	Unicorn-59001.exe
3472	Unicorn-42878.exe
4416	Unicorn-55685.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2400	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	90
PID 4788 wrote to memory of 2400	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	90
PID 4788 wrote to memory of 2400	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	90
PID 2400 wrote to memory of 4488	2400	Unicorn-33454.exe	96
PID 2400 wrote to memory of 4488	2400	Unicorn-33454.exe	96
PID 2400 wrote to memory of 4488	2400	Unicorn-33454.exe	96
PID 4788 wrote to memory of 2748	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	97
PID 4788 wrote to memory of 2748	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	97
PID 4788 wrote to memory of 2748	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	97
PID 2748 wrote to memory of 4764	2748	Unicorn-16084.exe	100
PID 2748 wrote to memory of 4764	2748	Unicorn-16084.exe	100
PID 2748 wrote to memory of 4764	2748	Unicorn-16084.exe	100
PID 4488 wrote to memory of 2616	4488	Unicorn-27782.exe	101
PID 4488 wrote to memory of 2616	4488	Unicorn-27782.exe	101
PID 4488 wrote to memory of 2616	4488	Unicorn-27782.exe	101
PID 4788 wrote to memory of 2916	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	103
PID 4788 wrote to memory of 2916	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	103
PID 4788 wrote to memory of 2916	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	103
PID 2400 wrote to memory of 1688	2400	Unicorn-33454.exe	102
PID 2400 wrote to memory of 1688	2400	Unicorn-33454.exe	102
PID 2400 wrote to memory of 1688	2400	Unicorn-33454.exe	102
PID 2616 wrote to memory of 4104	2616	Unicorn-23034.exe	107
PID 2616 wrote to memory of 4104	2616	Unicorn-23034.exe	107
PID 2616 wrote to memory of 4104	2616	Unicorn-23034.exe	107
PID 4488 wrote to memory of 2356	4488	Unicorn-27782.exe	108
PID 4488 wrote to memory of 2356	4488	Unicorn-27782.exe	108
PID 4488 wrote to memory of 2356	4488	Unicorn-27782.exe	108
PID 2916 wrote to memory of 2912	2916	Unicorn-57360.exe	109
PID 2916 wrote to memory of 2912	2916	Unicorn-57360.exe	109
PID 2916 wrote to memory of 2912	2916	Unicorn-57360.exe	109
PID 4764 wrote to memory of 4884	4764	Unicorn-23034.exe	110
PID 4764 wrote to memory of 4884	4764	Unicorn-23034.exe	110
PID 4764 wrote to memory of 4884	4764	Unicorn-23034.exe	110
PID 4788 wrote to memory of 3824	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	111
PID 4788 wrote to memory of 3824	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	111
PID 4788 wrote to memory of 3824	4788	b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe	111
PID 2748 wrote to memory of 3028	2748	Unicorn-16084.exe	113
PID 2748 wrote to memory of 3028	2748	Unicorn-16084.exe	113
PID 2748 wrote to memory of 3028	2748	Unicorn-16084.exe	113
PID 2400 wrote to memory of 4556	2400	Unicorn-33454.exe	112
PID 2400 wrote to memory of 4556	2400	Unicorn-33454.exe	112
PID 2400 wrote to memory of 4556	2400	Unicorn-33454.exe	112
PID 1688 wrote to memory of 2248	1688	Unicorn-43624.exe	114
PID 1688 wrote to memory of 2248	1688	Unicorn-43624.exe	114
PID 1688 wrote to memory of 2248	1688	Unicorn-43624.exe	114
PID 4104 wrote to memory of 224	4104	Unicorn-5493.exe	115
PID 4104 wrote to memory of 224	4104	Unicorn-5493.exe	115
PID 4104 wrote to memory of 224	4104	Unicorn-5493.exe	115
PID 2616 wrote to memory of 4020	2616	Unicorn-23034.exe	116
PID 2616 wrote to memory of 4020	2616	Unicorn-23034.exe	116
PID 2616 wrote to memory of 4020	2616	Unicorn-23034.exe	116
PID 2356 wrote to memory of 5040	2356	Unicorn-1964.exe	117
PID 2356 wrote to memory of 5040	2356	Unicorn-1964.exe	117
PID 2356 wrote to memory of 5040	2356	Unicorn-1964.exe	117
PID 4488 wrote to memory of 824	4488	Unicorn-27782.exe	118
PID 4488 wrote to memory of 824	4488	Unicorn-27782.exe	118
PID 4488 wrote to memory of 824	4488	Unicorn-27782.exe	118
PID 2912 wrote to memory of 2420	2912	Unicorn-1601.exe	119
PID 2912 wrote to memory of 2420	2912	Unicorn-1601.exe	119
PID 2912 wrote to memory of 2420	2912	Unicorn-1601.exe	119
PID 4556 wrote to memory of 856	4556	Unicorn-15891.exe	120
PID 4556 wrote to memory of 856	4556	Unicorn-15891.exe	120
PID 4556 wrote to memory of 856	4556	Unicorn-15891.exe	120
PID 2400 wrote to memory of 2928	2400	Unicorn-33454.exe	121

C:\Users\Admin\AppData\Local\Temp\b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe
"C:\Users\Admin\AppData\Local\Temp\b783a18eedea103c79595c4012900e9dc91c9f4df1849139060a5a1c1b3649ba.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        8⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17518.exe
        9⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        10⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        10⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        9⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        10⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        10⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        9⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        9⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        9⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        9⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        9⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        8⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        8⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        9⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        10⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        10⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        9⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        9⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        9⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        9⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        8⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
        8⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        8⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        8⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        8⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
        7⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        9⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        9⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40126.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        8⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        7⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60168.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
        6⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42878.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        10⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        10⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8576.exe
        9⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        9⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
        8⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1515.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        8⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        8⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
        7⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        9⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36456.exe
        9⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        9⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        7⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30806.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        7⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37236.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29277.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
        6⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40834.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56056.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        7⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19508.exe
        7⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
        6⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        7⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        7⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        6⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55885.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
        5⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18810.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46106.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
        9⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33354.exe
        10⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        9⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        9⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        9⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        8⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        8⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        8⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34880.exe
        6⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        8⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        9⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        8⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        7⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46106.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
        9⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        9⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48988.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        7⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        5⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        7⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        5⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        6⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        5⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62617.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        7⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        7⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        7⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        6⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
        7⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        6⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        6⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
        5⤵
        
        PID:15832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        5⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22370.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55096.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17895.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        6⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
        5⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        5⤵
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48852.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        5⤵
        
        PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
      4⤵
      PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
      4⤵
      PID:12888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-524.exe
      4⤵
      PID:16776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37170.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        9⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        9⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        8⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        8⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        8⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        6⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50050.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        8⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 636
        8⤵
        Program crash
        
        PID:14772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 728
        7⤵
        Program crash
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        6⤵
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35171.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6957.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        6⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52752.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        8⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        6⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        5⤵
        
        PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        7⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
        6⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55494.exe
        6⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        6⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47225.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exe
      4⤵
      PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
      4⤵
      PID:15372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 480
        5⤵
        Program crash
        
        PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
      4⤵
      Executes dropped EXE
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        7⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        6⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        5⤵
        
        PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        5⤵
        
        PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
      4⤵
      PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36720.exe
      4⤵
      PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
      4⤵
      PID:15896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        5⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8576.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
        7⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        6⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        5⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        6⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        5⤵
        
        PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
      4⤵
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33854.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
        6⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        5⤵
        
        PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        5⤵
        
        PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        5⤵
        
        PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58057.exe
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
      4⤵
      PID:16272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18530.exe
      4⤵
      PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-209.exe
        7⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        5⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20240.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64533.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        5⤵
        
        PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
      4⤵
      PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
      4⤵
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
      4⤵
      PID:16200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34672.exe
    3⤵
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58657.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        5⤵
        
        PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
      4⤵
      PID:11568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      4⤵
      PID:15652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
    3⤵
    PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
      4⤵
      PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
    3⤵
    PID:8640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
    3⤵
    PID:11504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
    3⤵
    PID:14676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
        9⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40052.exe
        8⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
        8⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49749.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
        7⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        6⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24445.exe
        6⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        8⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        7⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        7⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21227.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43626.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        6⤵
        
        PID:13864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32754.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        8⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe
        8⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        7⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        6⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9840.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        6⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        5⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        6⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        5⤵
        
        PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48360.exe
        5⤵
        
        PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
        6⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16527.exe
      4⤵
      PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47716.exe
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
      4⤵
      PID:14392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10324.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        8⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
        7⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        7⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        6⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        7⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        6⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        5⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        5⤵
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        6⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6115.exe
        5⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26755.exe
      4⤵
      PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        5⤵
        
        PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
      4⤵
      PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28606.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        6⤵
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        6⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        6⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
        5⤵
        
        PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        5⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
        6⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
      4⤵
      PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe
        5⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57925.exe
      4⤵
      PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
      4⤵
      PID:15340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51728.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37496.exe
      4⤵
      PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        5⤵
        
        PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
      4⤵
      PID:14952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
      4⤵
      PID:10020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
      4⤵
      PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
      4⤵
      PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
    3⤵
    PID:8004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
    3⤵
    PID:11260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
    3⤵
    PID:15296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        8⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        7⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        6⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4448.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29372.exe
        5⤵
        
        PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        6⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62665.exe
        5⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
        6⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4639.exe
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        5⤵
        
        PID:13760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        5⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
      4⤵
      PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        8⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        6⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        6⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        5⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
        5⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        5⤵
        
        PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41004.exe
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
      4⤵
      PID:16696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        5⤵
        
        PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23398.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
      4⤵
      PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
      4⤵
      PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
    3⤵
    PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
      4⤵
      PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27031.exe
      4⤵
      PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23157.exe
      4⤵
      PID:16744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
    3⤵
    PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
      4⤵
      PID:16084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe
    3⤵
    PID:11200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21756.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21756.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        7⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        6⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35162.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        5⤵
        
        PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34216.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        6⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21227.exe
        5⤵
        
        PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        5⤵
        
        PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
      4⤵
      PID:10980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
      4⤵
      PID:16472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 464
      4⤵
      Program crash
      PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
    3⤵
    PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
      4⤵
      PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
      4⤵
      PID:16876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
    3⤵
    PID:8756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
    3⤵
    PID:11592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11607.exe
    3⤵
    PID:15732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        6⤵
        
        PID:16548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
        5⤵
        
        PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10577.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37992.exe
        5⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        5⤵
        
        PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
      4⤵
      PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
      4⤵
      PID:16908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42576.exe
    3⤵
    PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34778.exe
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
      4⤵
      PID:14752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
    3⤵
    PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
    3⤵
    PID:11208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
    3⤵
    PID:15212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7132.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7132.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
    3⤵
    PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6625.exe
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        5⤵
        
        PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
      4⤵
      PID:13788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
    3⤵
    PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      4⤵
      PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
    3⤵
    PID:8220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
    3⤵
    PID:15120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13059.exe
    3⤵
    PID:5696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
  2⤵
  PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
    3⤵
    PID:8872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
    3⤵
    PID:11688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
    3⤵
    PID:15284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65148.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65148.exe
  2⤵
  PID:7980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
    3⤵
    PID:12488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
    3⤵
    PID:15392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
  2⤵
  PID:15156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 856 -ip 856
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1976 -ip 1976
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5568 -ip 5568
1⤵
PID:9912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6704 -ip 6704
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10324.exe

Filesize
468KB

MD5
2956ae970e919e03ef5548cc4b6ee4ce

SHA1
2560b3b3094e49ab4de0afd3d42865336ce8c1dc

SHA256
c2ddba020a323489cada6a532eb14b95b729452b94fc7b1769fbccede4ea849b

SHA512
dbaa63eed0d8866d966578373a7bc38e50f018dc82f59865e74ec83e201e6d5d4d5b656b07351861915c5732862ea42432d26f1e59f0bb540e7d1a79fb52dcfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe

Filesize
468KB

MD5
25992f9c9403764865674292d4e57551

SHA1
b5d84f490b85507577cd03fb76afee59e7205a11

SHA256
c38f1af2080b73a03d486fff77a1722de77e6acabaa262554781afe303288d0c

SHA512
812eee741a74df477bcd2910da352d392ce3726d78784191e02718dcfb5547209fc13a40150567b4646ccf4e8afa6a3d58e57e8dec4905d0c3859943f6ec00d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe

Filesize
468KB

MD5
9088018555fc5dccaf2cad3a6dd5a4c0

SHA1
993db470c10c30311ad89670b020c0fd2dc4bf12

SHA256
b3e5581b2dc217f419cfe66b8bc1815f6d2ba7a4f460542525dafdbfd030a3dc

SHA512
8cce92f75a667c3eb61698e30f4b7651a3654a4e20011387ff8edd36d989616161f9466aed971f1087bc17968320fdc50d182861d367c241ba58cceab8746ce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe

Filesize
468KB

MD5
88de72142d9b2d6d17a785f1448be1af

SHA1
00423fd324aa6315403680798ddb3f36c9c4c98a

SHA256
e33da2f3b405ecc564ec67188e750c8384afe3ccda5e8a5aa8a9524ad2ee5f8b

SHA512
e8258df3fe7ce64fb301259889b2d5651681111ed7c052004032af1037188e411f15dac5764ce78f1f37952dbe5912c011ea26de9ffe87c39582e2675fae1696

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe

Filesize
468KB

MD5
9a8c1a8da299a8750a955649ede6a1cb

SHA1
05c3f158c1bbcf1a4fef94d3a12961bc96b867e4

SHA256
f8e6fd2b2a7c24d25f93fc541412fb61e9da698791c14ad5268d6662305d62b3

SHA512
fa5cb51859a92111ec0deffee9d1ea13e344aed94b246dc81c55563ac3ccc674627147829fb1aa574e99d87e0496737536357b0769d8be37f6dc1e27506151bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe

Filesize
468KB

MD5
2b464acf9b9f6a4e592e70e49a8bd5e9

SHA1
a326af804fca99482e2eac1a7acde4884762727c

SHA256
8a1b6174304fd946766f9a23dff8eecb48cbd80554a4e8123d1b4bd3119378c0

SHA512
7bf6ab91d61cba95ede4d2388c3887ce865d027fd23f1bef62a957d9a043e304c75108e5fedf7bf4cc76fadf78e74dc13a6acaceeea6e8906a1954e16f0926f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18810.exe

Filesize
468KB

MD5
0c8ab86bbe9f36a1ef57720d8ef56d74

SHA1
37a738f15fae598e181d28f6ab4f9fe911973e55

SHA256
ad6cf8d1891194db60cae9bbce11b00ac06f6546ca3983f04eb537749eba75ef

SHA512
3d6cdb1e5b54da874abac15ddf4799ff28e359ed5967a31676b2b577d47630beb69ef545041ded63209404c1a18f406beb277cdab7e0729712368421e9cd0e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1964.exe

Filesize
468KB

MD5
1a0e969935ea92a97504c9187d1b1b31

SHA1
c68db37921d14e1cc8d62134b53cfc5eee55c42a

SHA256
2e69626f218cc3ee44ed3670a582ec7dc6bc7cc574a9930b19e54598043fee83

SHA512
7d7577a742321fadc0d00bd5e79a5fc37dc9911215ece6193772d141333d174eeae45e74e53f8f248ff77322a881c576c8da69cf3922a569878c85fbd049a297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe

Filesize
468KB

MD5
d17d55a742279048ddbc0a8088fef2e0

SHA1
fc4a18ef4cc2fae53297ebf285ef761b4d3d6167

SHA256
d5a07cf6d7e7de034db9d7aa9bf3c0df86e8925d706ca2bda3d72f96323e02ea

SHA512
d2521bf168335e158f818a6da7d03a3ad02d85199c4ecf05d1c6f6e4aeb895f98dca0b7142b9837b5944c8026139a13e5111c4a96c8ac14a7a623a2c7151277e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21756.exe

Filesize
468KB

MD5
e9ce482c30c6bb4443bd7a3e0fe717b1

SHA1
1c29286ffe33f6223d2ea91ff45f3564c633bf06

SHA256
6dbc51fc17037c3939e76bd8c5f9859c35e2cbae6ecb4afb082bbfccdfa301b4

SHA512
f495f70f8780871e504cd660f74e732bf171b2df20ff0c39244f49df8ddafe4759592f83b2399487245ea1f55ecbfe01fa77bd48b02d706b06f83bd59db66e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe

Filesize
468KB

MD5
b6e4ec1295f4c4b1a9846762d4709199

SHA1
464113d1965252aca3866e8a189d5a4efc6f8c1a

SHA256
ce35dab2104e936161591a1e182cc0d915bd2508e7f11c694083c2cb42294037

SHA512
b215c86b7731e7484a39842420d20195bfb73fe0a92921802d7254adafb15c872bc47eccc7bdb36850a7f02efff64a4f979bb05c6cb7f362d524ffdf8d99af4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe

Filesize
468KB

MD5
db14693de7c374f46809109919b721e7

SHA1
59ecf3c727398117d27ce513785857a3af259673

SHA256
6bde52cf6b95302b65bc92f67cb53dbd2842a848eb390b4860384b06281726ab

SHA512
faf5d47fa0d792a07846efc28f4f9415fa27cb80c1c62aa9bef1ef649e00d7ec2a1568a6c0c5a80fe60a4d87ad5f3a6c31cf91cefb877933d8fc1b266977ee76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe

Filesize
468KB

MD5
1dbdf07c341be306191bfcf29e01c825

SHA1
b6f04e3b74545f25d5d30c989ffced84f586f95f

SHA256
fd3f96b94f88b32bddf3d47b56095911bee5df15915175dca40c5bac3959cafd

SHA512
2cb080430655d838cf4e8a42588cc1b8a9383aacdf233e2ba39d8d6ea89f6ad2289d61e2bcf4fc7d7ec9e1295c7a409c5800a6ac7a07414a5d33d1a70c7c3e78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe

Filesize
468KB

MD5
40b9759eed1bdeca38bd1c7a78ee323f

SHA1
4743a285e03af58cdf3079d3be5f519f2df28441

SHA256
2c3046d06062303cf0dc9cbf815a94d856a2596549d9d19fbd296359a8d874b5

SHA512
31e8710e42d0b1a5942c33503d5e99cf56a903909921d180404d7b49d2a72619ff4c03923551e125322367f84defbb1dc625c53ad28d8576ca71ed1684d356cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe

Filesize
468KB

MD5
f6cc309b9f955765fabaa60b5a9fa76f

SHA1
f41f50700592687b9a120839d5b6f5abb3993d8b

SHA256
31424dd10b572b570d013fa08a7f56fa763558da285c521b0d9e62458cdada22

SHA512
9aebcffb3dd8d5c4d3882c12175fb2f8bc14fe60f8114b23466207cb3a2541881c32bb7f20c4c85a07b723254ef3b0ef45e8df2e26b7b0ef81c8e641dc8cb3b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe

Filesize
468KB

MD5
d194dae85346645ba724f69558f86b80

SHA1
98c89786ba25187acf5be6f50fc0e12719b01cc5

SHA256
4672462db9f71a45cbb5500cb4edac292891ab89421080ec1dc6ffeb1c1ef643

SHA512
1bdf017bbcb08b29176247d66cb14bfe149f7b32faa126bc0743b24fae0a02e789dc6cd4bbc90706ba47f3b5dd3d48f58beac295be3d131f2b12c0455ef084b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe

Filesize
468KB

MD5
d9483aa0f291724f7d6d06db0a10f876

SHA1
cb8eb587840da8c72961943f5250efccfdf2d2e2

SHA256
ef23665090f0b7de9025c1003898fe25355f964496178ceaaf6517a699b9bb48

SHA512
8a37f113f75019c7cb27cd4c0761945c0944099dd0d11c741b959f6d7d3242d97426827efa40ef5d47672225aec6b236c5bb7abc817004d535ee2179718e4ff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe

Filesize
468KB

MD5
3c56a8aedb9d8417d85660796683a9e4

SHA1
455896c2bf37cd1013a2eb8ca59b7509198c13ab

SHA256
4054809c0abde2f2da2ee9f4cc1d89176bf0c569e1a1ff74c1be5db0600dd434

SHA512
d1b38d8d2291e19213113894c44d8ebf80723ad56608406ca1182d1049eff877bbfac29162cb0b2c39b411bf933c9d7dbda8d4755d194feb9b753cd93817ebb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe

Filesize
468KB

MD5
6e12de73cbe386f726a5f461a90a46ff

SHA1
b6df7f2083cab9e239e7b02037b5deb4278831ce

SHA256
1bf55e4f61b920fb0ebd7f40fad28900fe7c07c01117b1b4ba60d5cc92bd9d38

SHA512
2f8c53a28a52c5b83f7e52ec575eb80b1ee35aa081d5e1c47b9c903a8baf11094572114a59733ff11733c25e3c755259334a70d763df9143ab777cd645c71f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe

Filesize
468KB

MD5
fb197803b914e7c8501b4e9f55ca0191

SHA1
274d5a9d6e509e16be5a5c777c2eb8d73a616f0f

SHA256
60f7188dbab5563983761091d0587aff89f88fe6cfaf9b6fd68d54272bf754c0

SHA512
78ddc76ec7d3f8d08808c0f71c5627475d295b4d65662fa542f07981b9da68b37f2cf401544ab95d7557aeaf1eaaac3518e2a5acfe2311174c3a92ecae6a3a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe

Filesize
468KB

MD5
291b41e72a867585bea61d90a421a9f1

SHA1
7edf0a14496bc3d52f3dbdc1a9f31aa850aa146b

SHA256
80777eeedf917ce0cbfc57ebe39d1c6c526eb7577689c199fa2a5066f6906168

SHA512
50616d473b68293844338a1a61035282c5d20218c81312ac8118b8bec04161f320981c4e19206c8951cc4d5e76d96ad566ff03e316901f19dc20795601d15119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe

Filesize
468KB

MD5
2dd23764970581e6f903e7bb143c7329

SHA1
738745adb23d5c2d07c8b6b95a9b1b6f026b6435

SHA256
059f181e1ed0e869d361f416e8643012feb28337a225679355ae56881c6b71ba

SHA512
bd5e84ae1d327ea23750b02487e1e2c55e0738c4ba4f4ee3e594aa40bdbb61be6db0ff3746950c1d1bbceb3d4c796060e1e2e08802815aed79b48d3b61e9145c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe

Filesize
468KB

MD5
f6cd57248ad131df75a113a5c799c407

SHA1
a127807abf54f35f7875ce6d79fb6846a3eef557

SHA256
89953758610e0409dc3f9204c13dcf626dca9d34021c9fd4bb331e97540f073e

SHA512
1013e011075fc08253e14923b78baf77e4e6a166171832ce036172030cfc14dfedb0bba9badae9c45d2c39f6ef13b156e6969e7149de51af55136e878081bb6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52752.exe

Filesize
468KB

MD5
83d61e2704c2bae8aac80e55ddbe91c2

SHA1
a65f1c0b736ba5108cb7021dbb2bc42902669238

SHA256
841729c0d9af42c55a0b2ee05cda0461a811d550b45efd2234efa72e41b3e7c2

SHA512
2f23e9a15f93c3d736f85ca6a6097ba4c4f763b67056a5332110414db97e6c46ce0a678dae7408f356f2a7b671688f5d000658d6b051c78a73eb539ffca053c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe

Filesize
468KB

MD5
e48ff9f513ac4b06cf2dc3d8e31315e6

SHA1
0b39484b36481499e9c4df78272972596acbd75a

SHA256
d1313f3b5720bc0c47f1e17da7d1d29a9d34b92f4019c4e8ce2d2d1279637bb6

SHA512
646819bfd7ebe4e8759e8c953464024f1bc12c46fddf224aed357a49328e0e1276f059c12fe3df7db54483b643fcfefb81a9b3c3699a317130e975848510b1f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe

Filesize
468KB

MD5
0cecd9cb4b7ad7d693a7be491c6e8c05

SHA1
809c7cd6d074665ba65d5ca32edecf2518a3b019

SHA256
c23c60ff0c1d430b8904c4487f61bf65460e251e4499b1c7ebf1439a63061060

SHA512
08c312d4505ece1b4da4d4f0f862d54e5d9b9d8e696e037766363667c0aa73c4b726f5191280b3c49aa441cf897f7c3f418cf9ab3772d54df94027ea71e95a42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe

Filesize
468KB

MD5
1c3a91704f31a389d50fe58ec1f54bda

SHA1
4940729a176f88f3ca44e97985fab0d953e9a249

SHA256
5216942325aa01711d005bc4142d0e882f0bea6d27060fc52271a5a719fd7d52

SHA512
75a1309a2656097b24ac85b3f3e85c08dfc26d83e99bcca50b8cb4ac5974392eb6cd694d28f7ce042a192f6cb487af995c0df780c2568d768f002040346dc530

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe

Filesize
468KB

MD5
21c8cda849bcd8bbc80690fb236aca8c

SHA1
b1dcec2560c6ea83c6a8dc618925bdc8e9a5ea90

SHA256
a63b6964d8913196b26852a7e7f090fa623cdf05cf1e0b2ca510f9459bf0c53f

SHA512
7c64e5ebc3bb5cd6d5b5eaa258899c7d3504f5db1d01404aea72445a896f68957ac823f5cad9afec45f26e780e6aaa2529de6dad9db435e9e658cd4b29a9f3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe

Filesize
468KB

MD5
e3a307c9423846566490079cf25eb258

SHA1
08184e0930b34b74a692af9c4caa1d3f2ca63644

SHA256
284b70d95ff817c25cd3cf034ade0f550ae59bbbcc694c83ad52d62c40b9526f

SHA512
fe0e2be6007bedb6b06590e543ef5a8016159aabd5233f13da7b59e3ac0591d513fa65b4d71f6839ed96f9075b1bf07b38e8f6b95e8abeba2fb752aab49526e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe

Filesize
468KB

MD5
e8e4352744f3fb79a4eb99476640ee13

SHA1
7668bc7ac50f94943818bfa9ca66890ac2634a6b

SHA256
c72a88ace5a8d86c3f4545b0c675602f676ce5c1461eca45c31997129ddad95c

SHA512
505ed2054bbdab0a45c492f5bb2a4fb4bcf05e08dd660a26534909f99347623eb050e798936502f229a31c6ca52a3d4ff1489ee935383ea70fa3290d1f61c579

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe

Filesize
468KB

MD5
20678cd373d182c3e1b6e4d16873d4e7

SHA1
4c77c7fc9ab867a3f10a90fb28a5930752a002f0

SHA256
d0823a4694b18a40b462e39e0f23f670233f3dcdc8f257af3648a6acdbc2808c

SHA512
026d943fa36355d716b548d0a96cce70623986af84b3eef4b71cdd463fff6f97ff32d4dbdfb4893b5ff60f9878c3cfe7b4c98b12587907dbfcbec8cb08af6dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe

Filesize
468KB

MD5
2af97a11f4e35cfd1d5096bdff57b5de

SHA1
77398404bde4a29fcc221c4f1ea2042ef6c7c0bb

SHA256
5d431a6bc17d95ca69afc97bb40d823bf22fedb3be4302fc1f76278947a6d341

SHA512
1fbe5ed9a147522f85095fee08061207383942252ccd12c363685f2f092b11af0e5e5e84129d078cfbe4510f3bf8d650597ae1cbd33beee549bf7733dc369c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe

Filesize
468KB

MD5
4c4577be3a30f64e9eca8267e656f598

SHA1
8658cecbeb282cfe33f814cfa7252604380541ba

SHA256
5d537aa3385ed492059176398a23e0b04264f2baf6b27b4840d36fec9e69c52e

SHA512
9d3aa6ad1a532e9a1c45803ddc4d1e360fe5bbf0358fe62e7b38f0054a6cb2b1ec44dc00dc972a2e33cc56f3737b05830f48726fcedefa2a0f171d78412c7aad

Download Submit