097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe
Size

468KB
MD5

af60abad2ee7ca94e2390968580b2cc0
SHA1

282e07728ce187f72a86b0090fa09d1bf77d7404
SHA256

097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358
SHA512

9422244815f613b27bd350d158daec902452d2560835895d2bee624ba7a0f9ab49572fa79d5b706be5d14bda11da186915bdbc379f24821dddfa662d3bfbc4c7
SSDEEP

3072:bbAhZ51V08U1bYTPzEjSf8FECDbSSO3udH0ZV4RHqO3pK7NGIl4:bb2T5U1EPgjSfjVboHqEQ7NG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2528	Unicorn-31360.exe
5068	Unicorn-24064.exe
5016	Unicorn-45231.exe
3864	Unicorn-18496.exe
1432	Unicorn-35024.exe
5084	Unicorn-53398.exe
4388	Unicorn-31494.exe
4528	Unicorn-3991.exe
1412	Unicorn-45024.exe
4792	Unicorn-25158.exe
2752	Unicorn-12351.exe
4632	Unicorn-20254.exe
1776	Unicorn-33518.exe
4924	Unicorn-45216.exe
4640	Unicorn-55614.exe
2068	Unicorn-37536.exe
2956	Unicorn-26030.exe
4816	Unicorn-46088.exe
3208	Unicorn-21510.exe
2556	Unicorn-30136.exe
2724	Unicorn-10462.exe
4180	Unicorn-30328.exe
3984	Unicorn-46664.exe
3988	Unicorn-64728.exe
428	Unicorn-15527.exe
2952	Unicorn-17757.exe
760	Unicorn-45055.exe
4352	Unicorn-55990.exe
3164	Unicorn-4022.exe
2252	Unicorn-37064.exe
4296	Unicorn-50255.exe
2300	Unicorn-4583.exe
5064	Unicorn-63990.exe
4332	Unicorn-2782.exe
2016	Unicorn-15942.exe
1656	Unicorn-8231.exe
3960	Unicorn-63.exe
3424	Unicorn-26296.exe
4796	Unicorn-29782.exe
2136	Unicorn-62647.exe
3020	Unicorn-32549.exe
3748	Unicorn-56384.exe
1684	Unicorn-56384.exe
1836	Unicorn-38896.exe
1916	Unicorn-285.exe
360	Unicorn-33149.exe
4316	Unicorn-27774.exe
2264	Unicorn-14967.exe
704	Unicorn-55808.exe
1832	Unicorn-167.exe
8	Unicorn-57728.exe
3396	Unicorn-49752.exe
3920	Unicorn-49752.exe
4472	Unicorn-48600.exe
3368	Unicorn-48600.exe
4952	Unicorn-14966.exe
2968	Unicorn-40432.exe
4896	Unicorn-37094.exe
2320	Unicorn-37094.exe
2880	Unicorn-40816.exe
3108	Unicorn-16046.exe
4064	Unicorn-61983.exe
1956	Unicorn-61983.exe
3172	Unicorn-10181.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10564	9148	WerFault.exe	431

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-74.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64222.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe
2528	Unicorn-31360.exe
5068	Unicorn-24064.exe
5016	Unicorn-45231.exe
3864	Unicorn-18496.exe
5084	Unicorn-53398.exe
1432	Unicorn-35024.exe
4388	Unicorn-31494.exe
4528	Unicorn-3991.exe
4792	Unicorn-25158.exe
2752	Unicorn-12351.exe
4640	Unicorn-55614.exe
4632	Unicorn-20254.exe
1412	Unicorn-45024.exe
1776	Unicorn-33518.exe
4924	Unicorn-45216.exe
2068	Unicorn-37536.exe
2956	Unicorn-26030.exe
4816	Unicorn-46088.exe
2556	Unicorn-30136.exe
3208	Unicorn-21510.exe
2724	Unicorn-10462.exe
4180	Unicorn-30328.exe
760	Unicorn-45055.exe
2952	Unicorn-17757.exe
3984	Unicorn-46664.exe
4352	Unicorn-55990.exe
428	Unicorn-15527.exe
3988	Unicorn-64728.exe
3164	Unicorn-4022.exe
2252	Unicorn-37064.exe
5064	Unicorn-63990.exe
4296	Unicorn-50255.exe
2300	Unicorn-4583.exe
4332	Unicorn-2782.exe
2016	Unicorn-15942.exe
3960	Unicorn-63.exe
1656	Unicorn-8231.exe
3424	Unicorn-26296.exe
2136	Unicorn-62647.exe
4796	Unicorn-29782.exe
3020	Unicorn-32549.exe
1684	Unicorn-56384.exe
3748	Unicorn-56384.exe
1836	Unicorn-38896.exe
1916	Unicorn-285.exe
360	Unicorn-33149.exe
4316	Unicorn-27774.exe
704	Unicorn-55808.exe
1832	Unicorn-167.exe
2264	Unicorn-14967.exe
3396	Unicorn-49752.exe
8	Unicorn-57728.exe
3920	Unicorn-49752.exe
2880	Unicorn-40816.exe
2320	Unicorn-37094.exe
4952	Unicorn-14966.exe
3368	Unicorn-48600.exe
4472	Unicorn-48600.exe
2968	Unicorn-40432.exe
4896	Unicorn-37094.exe
5196	Unicorn-1133.exe
5220	Unicorn-6534.exe
4200	Unicorn-43046.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2528	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	90
PID 2848 wrote to memory of 2528	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	90
PID 2848 wrote to memory of 2528	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	90
PID 2528 wrote to memory of 5068	2528	Unicorn-31360.exe	93
PID 2528 wrote to memory of 5068	2528	Unicorn-31360.exe	93
PID 2528 wrote to memory of 5068	2528	Unicorn-31360.exe	93
PID 2848 wrote to memory of 5016	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	94
PID 2848 wrote to memory of 5016	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	94
PID 2848 wrote to memory of 5016	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	94
PID 5016 wrote to memory of 3864	5016	Unicorn-45231.exe	98
PID 5016 wrote to memory of 3864	5016	Unicorn-45231.exe	98
PID 5016 wrote to memory of 3864	5016	Unicorn-45231.exe	98
PID 5068 wrote to memory of 1432	5068	Unicorn-24064.exe	99
PID 5068 wrote to memory of 1432	5068	Unicorn-24064.exe	99
PID 5068 wrote to memory of 1432	5068	Unicorn-24064.exe	99
PID 2848 wrote to memory of 5084	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	100
PID 2848 wrote to memory of 5084	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	100
PID 2848 wrote to memory of 5084	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	100
PID 2528 wrote to memory of 4388	2528	Unicorn-31360.exe	101
PID 2528 wrote to memory of 4388	2528	Unicorn-31360.exe	101
PID 2528 wrote to memory of 4388	2528	Unicorn-31360.exe	101
PID 3864 wrote to memory of 4528	3864	Unicorn-18496.exe	102
PID 3864 wrote to memory of 4528	3864	Unicorn-18496.exe	102
PID 3864 wrote to memory of 4528	3864	Unicorn-18496.exe	102
PID 5084 wrote to memory of 1412	5084	Unicorn-53398.exe	103
PID 5084 wrote to memory of 1412	5084	Unicorn-53398.exe	103
PID 5084 wrote to memory of 1412	5084	Unicorn-53398.exe	103
PID 5016 wrote to memory of 4792	5016	Unicorn-45231.exe	104
PID 5016 wrote to memory of 4792	5016	Unicorn-45231.exe	104
PID 5016 wrote to memory of 4792	5016	Unicorn-45231.exe	104
PID 2848 wrote to memory of 4632	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	105
PID 2848 wrote to memory of 4632	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	105
PID 2848 wrote to memory of 4632	2848	097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe	105
PID 1432 wrote to memory of 2752	1432	Unicorn-35024.exe	106
PID 1432 wrote to memory of 2752	1432	Unicorn-35024.exe	106
PID 1432 wrote to memory of 2752	1432	Unicorn-35024.exe	106
PID 5068 wrote to memory of 1776	5068	Unicorn-24064.exe	107
PID 5068 wrote to memory of 1776	5068	Unicorn-24064.exe	107
PID 5068 wrote to memory of 1776	5068	Unicorn-24064.exe	107
PID 4388 wrote to memory of 4924	4388	Unicorn-31494.exe	108
PID 4388 wrote to memory of 4924	4388	Unicorn-31494.exe	108
PID 4388 wrote to memory of 4924	4388	Unicorn-31494.exe	108
PID 2528 wrote to memory of 4640	2528	Unicorn-31360.exe	109
PID 2528 wrote to memory of 4640	2528	Unicorn-31360.exe	109
PID 2528 wrote to memory of 4640	2528	Unicorn-31360.exe	109
PID 4528 wrote to memory of 2068	4528	Unicorn-3991.exe	110
PID 4528 wrote to memory of 2068	4528	Unicorn-3991.exe	110
PID 4528 wrote to memory of 2068	4528	Unicorn-3991.exe	110
PID 3864 wrote to memory of 2956	3864	Unicorn-18496.exe	111
PID 3864 wrote to memory of 2956	3864	Unicorn-18496.exe	111
PID 3864 wrote to memory of 2956	3864	Unicorn-18496.exe	111
PID 4640 wrote to memory of 4816	4640	Unicorn-55614.exe	112
PID 4640 wrote to memory of 4816	4640	Unicorn-55614.exe	112
PID 4640 wrote to memory of 4816	4640	Unicorn-55614.exe	112
PID 2528 wrote to memory of 3208	2528	Unicorn-31360.exe	113
PID 2528 wrote to memory of 3208	2528	Unicorn-31360.exe	113
PID 2528 wrote to memory of 3208	2528	Unicorn-31360.exe	113
PID 1412 wrote to memory of 2556	1412	Unicorn-45024.exe	114
PID 1412 wrote to memory of 2556	1412	Unicorn-45024.exe	114
PID 1412 wrote to memory of 2556	1412	Unicorn-45024.exe	114
PID 5084 wrote to memory of 2724	5084	Unicorn-53398.exe	115
PID 5084 wrote to memory of 2724	5084	Unicorn-53398.exe	115
PID 5084 wrote to memory of 2724	5084	Unicorn-53398.exe	115
PID 1776 wrote to memory of 4180	1776	Unicorn-33518.exe	116

C:\Users\Admin\AppData\Local\Temp\097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe
"C:\Users\Admin\AppData\Local\Temp\097fdcf1685a15135d0cfbb25aebcff41cea083cae67a16f6faaa8c235805358N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24064.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41712.exe
        9⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        9⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        9⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64695.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        8⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1684.exe
        9⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        8⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        8⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-75.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-75.exe
        7⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
        8⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22746.exe
        7⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33456.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46475.exe
        8⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        7⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
        7⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        6⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10181.exe
        5⤵
        Executes dropped EXE
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
        7⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38980.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        6⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        6⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        5⤵
        
        PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57960.exe
        9⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        9⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        8⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9148 -s 468
        9⤵
        Program crash
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        8⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        8⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        7⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19688.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        8⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        7⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12791.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        7⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55996.exe
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        7⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        6⤵
        
        PID:13864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        5⤵
        
        PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
        8⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        7⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29660.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        6⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27768.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        7⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        6⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exe
        5⤵
        
        PID:14384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
      4⤵
      Executes dropped EXE
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        6⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49179.exe
        5⤵
        
        PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        5⤵
        
        PID:14064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51607.exe
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
      4⤵
      PID:12064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19434.exe
      4⤵
      PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57728.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        8⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53044.exe
        8⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        7⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        7⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52739.exe
        6⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        5⤵
        
        PID:720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        8⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        8⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe
        7⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exe
        6⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exe
        6⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17730.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34651.exe
        5⤵
        
        PID:14708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-367.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49880.exe
        8⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        6⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        5⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36470.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        6⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        5⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
        6⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        5⤵
        
        PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-282.exe
        7⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe
        6⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2970.exe
        5⤵
        
        PID:13968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
      4⤵
      PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
      4⤵
      PID:11552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
      4⤵
      PID:15496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        6⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
        8⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63003.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32643.exe
        8⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
        7⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        8⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        7⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
        6⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        7⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        6⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8461.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        6⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        5⤵
        
        PID:13972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46453.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        7⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        5⤵
        
        PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        6⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        5⤵
        
        PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        5⤵
        
        PID:12308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
      4⤵
      PID:13448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        7⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        6⤵
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        5⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        6⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        5⤵
        
        PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
      4⤵
      PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
      4⤵
      PID:13536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32549.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50072.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65523.exe
        6⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        5⤵
        
        PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28064.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16010.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        5⤵
        
        PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
      4⤵
      PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      4⤵
      PID:13188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33230.exe
    3⤵
    PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
      4⤵
      PID:13428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
    3⤵
    PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
      4⤵
      PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5924.exe
        5⤵
        
        PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      4⤵
      PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2970.exe
      4⤵
      PID:15416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
    3⤵
    PID:9228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
    3⤵
    PID:12624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27043.exe
    3⤵
    PID:7152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3991.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        9⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        9⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        8⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27843.exe
        7⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        7⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        9⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6146.exe
        9⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
        8⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        7⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        8⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        6⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        8⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7046.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50724.exe
        7⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-781.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        7⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        6⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
        7⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exe
        6⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        7⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        6⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40965.exe
        5⤵
        
        PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
        9⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        8⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        8⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        7⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52095.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        7⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63019.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61983.exe
        5⤵
        Executes dropped EXE
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        7⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25669.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        6⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe
        5⤵
        
        PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
        7⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        6⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        7⤵
        
        PID:14260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        6⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        5⤵
        
        PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        5⤵
        
        PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exe
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        5⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41722.exe
      4⤵
      PID:13316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        6⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        7⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        6⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        6⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        5⤵
        
        PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
      
      C:\Users\Admin\AppData\Local\Temp\Uni

Analysis

Sharing

General

Malware Config

Signatures

Processes