06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe
Size

184KB
MD5

598184611e051409f85832a6b846d4bc
SHA1

961e67bc97371131506d937b5b706f50ddd3c80a
SHA256

06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7
SHA512

192ecc02cae3c74f86a973c34964bc7e06d3f1dfa473a5c283753f805db1f992df448b74b951cf58e5751853ae7b66f51fb6b42a148e4ab718ad6720765809f1
SSDEEP

3072:4SffBkontdJ7zl2tWSr8PdAN6vNqnviuf:4SqoN/l2v81AN6Vqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3480	Unicorn-64720.exe
4036	Unicorn-30054.exe
1896	Unicorn-5955.exe
3232	Unicorn-3909.exe
4024	Unicorn-35696.exe
1824	Unicorn-58809.exe
4288	Unicorn-43864.exe
4280	Unicorn-47683.exe
3548	Unicorn-39526.exe
1068	Unicorn-62639.exe
3288	Unicorn-49640.exe
3036	Unicorn-53724.exe
2120	Unicorn-53724.exe
3708	Unicorn-25035.exe
3752	Unicorn-22235.exe
1696	Unicorn-37942.exe
1888	Unicorn-7813.exe
2916	Unicorn-18674.exe
1508	Unicorn-54876.exe
3044	Unicorn-30271.exe
4852	Unicorn-11705.exe
3832	Unicorn-35586.exe
1560	Unicorn-61482.exe
372	Unicorn-10890.exe
2156	Unicorn-16366.exe
2236	Unicorn-4668.exe
2624	Unicorn-54299.exe
4508	Unicorn-8097.exe
3448	Unicorn-13962.exe
60	Unicorn-40870.exe
920	Unicorn-44954.exe
4420	Unicorn-44954.exe
2736	Unicorn-10911.exe
4020	Unicorn-7382.exe
2152	Unicorn-27248.exe
1556	Unicorn-64096.exe
1904	Unicorn-51752.exe
3668	Unicorn-10096.exe
4304	Unicorn-27915.exe
5052	Unicorn-50117.exe
2776	Unicorn-46298.exe
3116	Unicorn-23740.exe
3004	Unicorn-7958.exe
1280	Unicorn-3127.exe
2668	Unicorn-27632.exe
640	Unicorn-20018.exe
3552	Unicorn-61072.exe
2616	Unicorn-32383.exe
4408	Unicorn-58934.exe
4548	Unicorn-43152.exe
3644	Unicorn-3603.exe
4880	Unicorn-11679.exe
2896	Unicorn-23667.exe
4092	Unicorn-32100.exe
3352	Unicorn-27253.exe
3272	Unicorn-44352.exe
3400	Unicorn-1928.exe
1660	Unicorn-57372.exe
1808	Unicorn-57372.exe
4432	Unicorn-30730.exe
3824	Unicorn-26414.exe
4780	Unicorn-45675.exe
2836	Unicorn-28400.exe
1196	Unicorn-12618.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1716	3480	WerFault.exe	90
13260	10968	WerFault.exe
2312	6844	WerFault.exe	266
16504	9464	WerFault.exe	395
6916	8924	WerFault.exe	381
5620	8924	WerFault.exe	381

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe
3480	Unicorn-64720.exe
4036	Unicorn-30054.exe
1896	Unicorn-5955.exe
3232	Unicorn-3909.exe
4024	Unicorn-35696.exe
4288	Unicorn-43864.exe
4280	Unicorn-47683.exe
1824	Unicorn-58809.exe
3548	Unicorn-39526.exe
1068	Unicorn-62639.exe
3288	Unicorn-49640.exe
3036	Unicorn-53724.exe
2120	Unicorn-53724.exe
3752	Unicorn-22235.exe
3708	Unicorn-25035.exe
1696	Unicorn-37942.exe
1888	Unicorn-7813.exe
2916	Unicorn-18674.exe
1508	Unicorn-54876.exe
3044	Unicorn-30271.exe
4852	Unicorn-11705.exe
1560	Unicorn-61482.exe
372	Unicorn-10890.exe
2156	Unicorn-16366.exe
2236	Unicorn-4668.exe
4508	Unicorn-8097.exe
3448	Unicorn-13962.exe
60	Unicorn-40870.exe
2624	Unicorn-54299.exe
920	Unicorn-44954.exe
4420	Unicorn-44954.exe
2736	Unicorn-10911.exe
4020	Unicorn-7382.exe
1556	Unicorn-64096.exe
2152	Unicorn-27248.exe
1904	Unicorn-51752.exe
3668	Unicorn-10096.exe
4304	Unicorn-27915.exe
5052	Unicorn-50117.exe
2776	Unicorn-46298.exe
3004	Unicorn-7958.exe
3116	Unicorn-23740.exe
1280	Unicorn-3127.exe
640	Unicorn-20018.exe
2668	Unicorn-27632.exe
3552	Unicorn-61072.exe
2616	Unicorn-32383.exe
4548	Unicorn-43152.exe
4408	Unicorn-58934.exe
3644	Unicorn-3603.exe
2896	Unicorn-23667.exe
4880	Unicorn-11679.exe
3352	Unicorn-27253.exe
4092	Unicorn-32100.exe
3272	Unicorn-44352.exe
1660	Unicorn-57372.exe
4432	Unicorn-30730.exe
1808	Unicorn-57372.exe
3400	Unicorn-1928.exe
3824	Unicorn-26414.exe
4780	Unicorn-45675.exe
1196	Unicorn-12618.exe
2836	Unicorn-28400.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3480	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	90
PID 3672 wrote to memory of 3480	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	90
PID 3672 wrote to memory of 3480	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	90
PID 3672 wrote to memory of 4036	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	95
PID 3672 wrote to memory of 4036	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	95
PID 3672 wrote to memory of 4036	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	95
PID 4036 wrote to memory of 1896	4036	Unicorn-30054.exe	96
PID 4036 wrote to memory of 1896	4036	Unicorn-30054.exe	96
PID 4036 wrote to memory of 1896	4036	Unicorn-30054.exe	96
PID 3672 wrote to memory of 3232	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	97
PID 3672 wrote to memory of 3232	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	97
PID 3672 wrote to memory of 3232	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	97
PID 1896 wrote to memory of 4024	1896	Unicorn-5955.exe	98
PID 1896 wrote to memory of 4024	1896	Unicorn-5955.exe	98
PID 1896 wrote to memory of 4024	1896	Unicorn-5955.exe	98
PID 4036 wrote to memory of 1824	4036	Unicorn-30054.exe	99
PID 4036 wrote to memory of 1824	4036	Unicorn-30054.exe	99
PID 4036 wrote to memory of 1824	4036	Unicorn-30054.exe	99
PID 3232 wrote to memory of 4288	3232	Unicorn-3909.exe	100
PID 3232 wrote to memory of 4288	3232	Unicorn-3909.exe	100
PID 3232 wrote to memory of 4288	3232	Unicorn-3909.exe	100
PID 3672 wrote to memory of 4280	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	101
PID 3672 wrote to memory of 4280	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	101
PID 3672 wrote to memory of 4280	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	101
PID 4024 wrote to memory of 3548	4024	Unicorn-35696.exe	102
PID 4024 wrote to memory of 3548	4024	Unicorn-35696.exe	102
PID 4024 wrote to memory of 3548	4024	Unicorn-35696.exe	102
PID 1896 wrote to memory of 1068	1896	Unicorn-5955.exe	103
PID 1896 wrote to memory of 1068	1896	Unicorn-5955.exe	103
PID 1896 wrote to memory of 1068	1896	Unicorn-5955.exe	103
PID 4288 wrote to memory of 3288	4288	Unicorn-43864.exe	104
PID 4288 wrote to memory of 3288	4288	Unicorn-43864.exe	104
PID 4288 wrote to memory of 3288	4288	Unicorn-43864.exe	104
PID 1824 wrote to memory of 3036	1824	Unicorn-58809.exe	106
PID 1824 wrote to memory of 3036	1824	Unicorn-58809.exe	106
PID 1824 wrote to memory of 3036	1824	Unicorn-58809.exe	106
PID 4280 wrote to memory of 2120	4280	Unicorn-47683.exe	105
PID 4280 wrote to memory of 2120	4280	Unicorn-47683.exe	105
PID 4280 wrote to memory of 2120	4280	Unicorn-47683.exe	105
PID 4036 wrote to memory of 3708	4036	Unicorn-30054.exe	108
PID 4036 wrote to memory of 3708	4036	Unicorn-30054.exe	108
PID 4036 wrote to memory of 3708	4036	Unicorn-30054.exe	108
PID 3672 wrote to memory of 3752	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	109
PID 3672 wrote to memory of 3752	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	109
PID 3672 wrote to memory of 3752	3672	06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe	109
PID 3232 wrote to memory of 1696	3232	Unicorn-3909.exe	107
PID 3232 wrote to memory of 1696	3232	Unicorn-3909.exe	107
PID 3232 wrote to memory of 1696	3232	Unicorn-3909.exe	107
PID 3548 wrote to memory of 1888	3548	Unicorn-39526.exe	110
PID 3548 wrote to memory of 1888	3548	Unicorn-39526.exe	110
PID 3548 wrote to memory of 1888	3548	Unicorn-39526.exe	110
PID 4024 wrote to memory of 2916	4024	Unicorn-35696.exe	111
PID 4024 wrote to memory of 2916	4024	Unicorn-35696.exe	111
PID 4024 wrote to memory of 2916	4024	Unicorn-35696.exe	111
PID 1068 wrote to memory of 1508	1068	Unicorn-62639.exe	112
PID 1068 wrote to memory of 1508	1068	Unicorn-62639.exe	112
PID 1068 wrote to memory of 1508	1068	Unicorn-62639.exe	112
PID 1896 wrote to memory of 3044	1896	Unicorn-5955.exe	113
PID 1896 wrote to memory of 3044	1896	Unicorn-5955.exe	113
PID 1896 wrote to memory of 3044	1896	Unicorn-5955.exe	113
PID 3288 wrote to memory of 4852	3288	Unicorn-49640.exe	114
PID 3288 wrote to memory of 4852	3288	Unicorn-49640.exe	114
PID 3288 wrote to memory of 4852	3288	Unicorn-49640.exe	114
PID 4288 wrote to memory of 3832	4288	Unicorn-43864.exe	115

C:\Users\Admin\AppData\Local\Temp\06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe
"C:\Users\Admin\AppData\Local\Temp\06b4a48f55b985d4a18693089d9900a41ffd3f02a694b038e9a63a391a4b90c7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 488
    3⤵
    - Program crash
    PID:1716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28400.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        9⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        10⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        10⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        10⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        9⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
        10⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        10⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        9⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        9⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        9⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        9⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        9⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        9⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        9⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        9⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        10⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        10⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        9⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        9⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        9⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        8⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        9⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        8⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        8⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        8⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38806.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        7⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        9⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        10⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        10⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18830.exe
        9⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        10⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        9⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        9⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40708.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        9⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        9⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        9⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        9⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31990.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        9⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36038.exe
        8⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        8⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56137.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        7⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
        7⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        9⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        9⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        8⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        7⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exe
        7⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        6⤵
        
        PID:15080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
        6⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        9⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
        10⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        9⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        9⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22400.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
        9⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        9⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10879.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        8⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        8⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        8⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        8⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56137.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38372.exe
        8⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        8⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        7⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39644.exe
        6⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        8⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        8⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        8⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        7⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
        7⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        6⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        6⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        8⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        8⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        7⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10968 -s 464
        8⤵
        Program crash
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15130.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        7⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        6⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        7⤵
        
        PID:15816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        7⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        6⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        7⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        6⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57290.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        5⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54876.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        7⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        9⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        9⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        9⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
        8⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exe
        8⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        7⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        6⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        8⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        7⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        7⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1159.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        7⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        6⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        9⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        8⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        7⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
        7⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62882.exe
        6⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        7⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        6⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25367.exe
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
        7⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45473.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53293.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50193.exe
        6⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        8⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        8⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6586.exe
        8⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        7⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
        7⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        7⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        6⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
        7⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        6⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
        5⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2411.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
        7⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46599.exe
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14516.exe
        6⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4449.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        6⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        5⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        7⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        7⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        7⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        6⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exe
        5⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        6⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        5⤵
        
        PID:16432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
      4⤵
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29184.exe
        6⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        7⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        6⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        5⤵
        
        PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
      4⤵
      PID:11908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
      4⤵
      PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21618.exe
        9⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        9⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        8⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        8⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36392.exe
        8⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        7⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20568.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        8⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        8⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        8⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        7⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46354.exe
        6⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61975.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        7⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        7⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
        6⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        6⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36392.exe
        7⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        6⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        6⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54733.exe
        5⤵
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        5⤵
        
        PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62416.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48120.exe
        8⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        8⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        6⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        7⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        6⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        7⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9894.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38300.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        6⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        6⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        5⤵
        
        PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2043.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-991.exe
        7⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53449.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        6⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8036.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        6⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        5⤵
        
        PID:8924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8924 -s 636
        6⤵
        Program crash
        
        PID:6916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8924 -s 636
        6⤵
        Program crash
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31745.exe
        5⤵
        
        PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        6⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        5⤵
        
        PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
      4⤵
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        5⤵
        
        PID:13896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
      4⤵
      PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
      4⤵
      PID:14880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25035.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64419.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        7⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21544.exe
        6⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        6⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        6⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        7⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        5⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        6⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        5⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        5⤵
        
        PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        5⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55098.exe
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe
        5⤵
        
        PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31680.exe
        5⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        6⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7206.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        5⤵
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
        5⤵
        
        PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
      4⤵
      PID:14464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
      4⤵
      PID:1992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42458.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46042.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        5⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
        6⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        5⤵
        
        PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        5⤵
        
        PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      4⤵
      PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29768.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51967.exe
      4⤵
      PID:14408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
      4⤵
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        5⤵
        
        PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        5⤵
        
        PID:14320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        5⤵
        
        PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
      4⤵
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe
      4⤵
      PID:17184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32804.exe
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
      4⤵
      PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46134.exe
      4⤵
      PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
    3⤵
    PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
    3⤵
    PID:10824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
    3⤵
    PID:14928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
    3⤵
    PID:13836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3909.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3909.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52302.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        9⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        10⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        9⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        9⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        8⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        8⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
        8⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        7⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        8⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        8⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
        7⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        6⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        6⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29768.exe
        9⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        8⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6987.exe
        7⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        7⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6445.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49680.exe
        5⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        7⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        5⤵
        
        PID:13404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        5⤵
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
      4⤵
      Executes dropped EXE
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36952.exe
        5⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52816.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        8⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57725.exe
        6⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
        6⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        6⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exe
        5⤵
        
        PID:6844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 632
        6⤵
        Program crash
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        5⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        6⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        5⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
        5⤵
        
        PID:10900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
      4⤵
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46162.exe
        5⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
        6⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        5⤵
        
        PID:11280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        5⤵
        
        PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
      4⤵
      PID:12496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
      4⤵
      PID:15680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40846.exe
        8⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        7⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
        6⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        7⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        7⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        6⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        5⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42620.exe
        5⤵
        
        PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        6⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        6⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29583.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe
        5⤵
        
        PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
      4⤵
      PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
      4⤵
      PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
      4⤵
      PID:12368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        6⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        5⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        5⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        5⤵
        
        PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
      4⤵
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        5⤵
        
        PID:9464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9464 -s 720
        6⤵
        Program crash
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
      4⤵
      PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        5⤵
        
        PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
      4⤵
      PID:11168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
      4⤵
      PID:9256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38976.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50655.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
        5⤵
        
        PID:15584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      4⤵
      PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        5⤵
        
        PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
      4⤵
      PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
      4⤵
      PID:14104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
    3⤵
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
      4⤵
      PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
      4⤵
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
      4⤵
      PID:15292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
    3⤵
    PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38722.exe
      4⤵
      PID:13668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
      4⤵
      PID:16720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
    3⤵
    PID:9936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
    3⤵
    PID:12940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
    3⤵
    PID:11076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        8⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        7⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56251.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        7⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        6⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        6⤵
        
        PID:17140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55379.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
        7⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        7⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        6⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        7⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        5⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        5⤵
        
        PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        6⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55760.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        6⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        5⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48100.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        5⤵
        
        PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        5⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        5⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        5⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
        5⤵
        
        PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15996.exe
      4⤵
      PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
      4⤵
      PID:15668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58934.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        5⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42700.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
        6⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        5⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        5⤵
        
        PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        5⤵
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        5⤵
        
        PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52306.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        5⤵
        
        PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
      4⤵
      PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        5⤵
        
        PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exe
      4⤵
      PID:12808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
      4⤵
      PID:16632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52686.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        5⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        5⤵
        
        PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
      4⤵
      PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        5⤵
        
        PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
      4⤵
      PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
      4⤵
      PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        5⤵
        
        PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-932.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
      4⤵
      PID:11660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
      4⤵
      PID:14608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
    3⤵
    PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
      4⤵
      PID:12332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
      4⤵
      PID:8552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
    3⤵
    PID:9652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
    3⤵
    PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
    3⤵
    PID:6252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19900.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        7⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5312.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        6⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        5⤵
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        5⤵
        
        PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
        5⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        6⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        5⤵
        
        PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
      4⤵
      PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
      4⤵
      PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
      4⤵
      PID:15496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1928.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        5⤵
        
        PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      4⤵
      PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        5⤵
        
        PID:15192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
      4⤵
      PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
      4⤵
      PID:10316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
    3⤵
    PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
    3⤵
    PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
      4⤵
      PID:11036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
    3⤵
    PID:10592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
    3⤵
    PID:14228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9691.exe
    3⤵
    PID:16348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        5⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
        6⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        5⤵
        
        PID:14576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      4⤵
      PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
        5⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
        5⤵
        
        PID:13976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
      4⤵
      PID:14652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
      4⤵
      PID:14212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
    3⤵
    PID:11384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
    3⤵
    PID:5680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      4⤵
      PID:13340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
    3⤵
    PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
      4⤵
      PID:16564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4081.exe
    3⤵
    PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
    3⤵
    PID:14556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
    3⤵
    PID:9472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
  2⤵
  PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
    3⤵
    PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
    3⤵
    PID:13152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
    3⤵
    PID:6360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
  2⤵
  PID:8172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
    3⤵
    PID:3720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9872.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9872.exe
  2⤵
  PID:10616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
  2⤵
  PID:10712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3480 -ip 3480
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 10968 -ip 10968
1⤵
PID:12740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6844 -ip 6844
1⤵
PID:11532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe

Filesize
184KB

MD5
c9d1b2e5e812fae679a291eb9386dd87

SHA1
90234f43d0bf2984a6ac707aa514aca7f1c9967b

SHA256
78015e6b97af6bc6283ce42ae19a4fefb5c48ff49a0ba8f69713df425811b311

SHA512
be30caff8603fb2b72381e2e7afc58b7c1a23ec71493464ab30e7f1f291b236156b1019914a14350cb313659b2e2e61f1b4db7b42357206dff9b08ac6dae0ffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe

Filesize
184KB

MD5
470b83a3c56eed85f868fc5556eac4fe

SHA1
9e8bee29b96b094517c055dd625febc31eee67f8

SHA256
23ac474a3bd0fc14f45bf8991a2deae0de00a973e083b13a0b43ff39a164ee4c

SHA512
faafd15eafaadf0be708a8faeab0d1c0202431804e8908fa3e988163067e5becd1fd43f77dfe171e93eaba12b18896f9aaa67be85a03097bf99f81b707a6f742

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe

Filesize
184KB

MD5
8a12510ed2e71d0b2512111176671e16

SHA1
ec1aa524ef0d4b9720f9b5b0fe3b9ffd6b1d915b

SHA256
2719ab1890ebabadfa668bc962adb878663fa9aa305c906167b43fb1aedad17c

SHA512
8d70184b75db7ab18b4713cc7336a1d7b7e5512c584cf980167261d0f182cf3062691bb4deff61d0c08dcfb724261c74d76a851068b4d9ab6ccc38f3b4fff767

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe

Filesize
184KB

MD5
919ccf272ce39a1827083983f972f600

SHA1
985f810673cb76134ce28d62138314039d5b461d

SHA256
cd6a43fff9a8ff5c472421d0c3c330f999939e20f00842843028830f19577c54

SHA512
ec1e2b7ea273c4f3eefe6a684607e6da9b4dbe7fa4111312c94d68285adfae6c533e4efe98191a6a91cf1862e2d5a153da6d6096820205b1d5954387b2b17fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe

Filesize
184KB

MD5
47f0817fc10916b5f3225625a75df92a

SHA1
c414222cd3c3a4b8bd4ddf78f369be782dfa4a35

SHA256
f63ea59c33b2154784ad6c4cd07da9331030dababe1cad5d9064c8315bbb339f

SHA512
f053b0c876343f7b7836c2b64107e1b1fba5e2492c483d13cfc0fc143c44f108b91ed4a07b27ee9ec9e0065f5f3d7eb2c498eff79c2526053be48bdc04fbe294

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe

Filesize
184KB

MD5
2dea44fc0d8a47c70592fe6e07c1eb99

SHA1
316283872f531b5d0052db66e94819673d8d5209

SHA256
b5f3358bff8086e7ea2eeb4b958787ea743194cf82d342b7003e2bf526275f43

SHA512
262f51e1eb62737c5d2c847fc3a3c94137bef058207ed3f0899b149198b43767ce18da752b8e55ab28e93279d4dcf5b22a113f45c71d08a21f80cc9a60d28de9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe

Filesize
184KB

MD5
8a86d7279591a2ad9a3223db356cfc69

SHA1
56f910fe725dcb3447e862887ad79b6e6148a5b1

SHA256
7d7a7dd3823f9a1ad49c920bfc1a0bf95dc776ba9892f1f1f924d636c7a41322

SHA512
2055bc7a313ac4416c467a5d86e34781946467688f2ce08b6c57818bd9a68771cdafee9670545751efe6878badb0cb3f46097fc05239766a3fc5722ddea9ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe

Filesize
184KB

MD5
318368864ba272f52f501e5e926eaaf8

SHA1
59cdb180be0ccb75f0137ae993ef018e1295d7ba

SHA256
db694adff951ee6f54286f4446beb579a7a34f738e8a0cec28584ed6ba9f65f5

SHA512
80b937f4800c2dc0d4812cecfb4774b4a7a5e344bd23ad379c8bc88f3373a2e8a579ffb64a0e59a4d599d7439af4d9943df4f3ca5e10c209450fa744a11e80a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25035.exe

Filesize
184KB

MD5
ff2ab4b39f1682ba8c51f84afc703a90

SHA1
bb16e5192eacb5cf53922d2ce202aea142c1d8fc

SHA256
3086e1299e76bb5415640f19151f5c21ee082aa35a622900ab49ec59f4a7f943

SHA512
7e997e5aaa3034a2d9421cc2c53bb52384fb130d7f36f62881fecef70bf837dcde7dbbe4fa3fcd46e6b5eb5215abd6dc0ebe2b82a61816b585986f10687217c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe

Filesize
184KB

MD5
b2250c3b4156c628ca9939efdd9d70c5

SHA1
c0628dbb94b9a365c8dc9f6f0525128beec4cbd3

SHA256
d9bb8827cf0bdca7702d7ca684274ea052fffe9877cb9a1de6e3414cb8287747

SHA512
688b97bf69229a293ddea1a4ea2ac041bb198608a4ae1656e779ee2a1d56339a3776765dbe102a0d1a112e3bb1c134fc3b81a1b306d2961eb9d3ebf2165d1a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe

Filesize
184KB

MD5
d9af283f074da5d64fae2d90c1769758

SHA1
ce0f5da686213f434be11cfc942a7426690b2815

SHA256
9792df5e1d80b8cd1b958e69b4b51706a7ae343c79d7004834570691389da95f

SHA512
86c8416c62bcad0c05758fd28908f7aadd26889fd82f294c90dc5160b352995efa92794bda979f09f230a274c6c8e3e97c8429096908b2ff9cdba94f315264b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe

Filesize
184KB

MD5
82d6b839d68ee7837385f8797ee249ab

SHA1
c49a3f51c8a7d145b56551c5507183eae366cbf2

SHA256
6bd4e2109017df2ec0f3d6ff0b28e08377833e2be5732385ec441940fdf38719

SHA512
2764d6ed8d37cf8e9bba6630b27ee77422d59d60349c9df2e0f8ef366585b04898cfc1e0eff2b1fdf28103d719a0dda1cd1fc0a76115a8c8ae7a84dfe8689931

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe

Filesize
184KB

MD5
ef561dd5ea056ed5703a1e693a272612

SHA1
0f760c9716826b5e3b0b86dbdfd4c92c47007f1a

SHA256
1a0901b1582f4ac5a255200d111703ba061a639b774359c4376d7ee19a1c2537

SHA512
d41034c26b347a269827d9da6f1cd364fd8778cd0ae46285a3f882484e95f172015804c4854ccdcdcf1a9d1de10e0908c402a31d514d0da253a33de7032a0d3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe

Filesize
184KB

MD5
493ac95606d34188119c604fb790c336

SHA1
1ba79cf3329665aab2eff3b585010d53d1af9045

SHA256
de4a20766352dc4c011fa776a18d48fe021d372871de02fd3881c4f99f34b942

SHA512
c598d751682030f797298c84c721c65f973df03be733a3069c4c9867962b83002e8bd4cf466019f695ae71d3a06f09de55a77923ff6c3b6cd8c4dc7e465318ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3909.exe

Filesize
184KB

MD5
26c3863b8d495a8c3f235d4f805fdea4

SHA1
fc389f3c291f44a05103ff49e8938699a71c123e

SHA256
9db8c930058ff4a6cf553802d23ada66e9a428844539d676860be0a70feee9ef

SHA512
543f75cb6931adb779c494df30d65951419b1b74b0fd5c3ee07601304de20044b1ad0c9ca818bca5f6fb1720086877ce350d91ac818e9ba2b7f4bd9e08cc424c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe

Filesize
184KB

MD5
89d5d07f1f1ac5c041e675aa0fa00063

SHA1
c6691bcaf2b4cf65eaf54693598cb8e9e3fd9e85

SHA256
b7bfec656e88e3986b48d5c185511fa52f77ad0154a3c7a88b350c01329dd94b

SHA512
f3120fecf176c9b7ce54d8c3727010a536a47f4c31873fd412388bb2d1b9ab4f3fd372492098b8bd23c3e591b942b15ce9d5120cae0764bc11aacb4650def9ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe

Filesize
184KB

MD5
d7a5879ea393a700980768665800c219

SHA1
91f647010341045285c317958648841450e1a637

SHA256
5de357b48918e2fd7d5af76cec36b302a7503d10ea8084b8b87dad46c2b0dade

SHA512
f035c92f6e776bc743e9fa3690b440ce10139c4e57345bd3adb0934ae824f48e922665d8b303e13d6d90e2f452b1e67f7c81835931a0d6f7b27602f37df8d892

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe

Filesize
184KB

MD5
6468a30880b0ed36a9124e31ef81d72e

SHA1
9ac6af02febc6f45b3937b4938b206234ee93c3b

SHA256
b7242b1698a4b32f36146724cd5a73f3c6d13833c29d6643c04a363f163bd3b9

SHA512
54f6ff4f224521043f7fcfb94c27be59693d66df8732f25f75d35c081dc9f38f8ca00fedd4fb124e9170e733875fd5ab04f421aac912abbd85a4af48e47a8ceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe

Filesize
184KB

MD5
5d7eec8a1b3ac56343774838b33c4551

SHA1
38cd1a5420e448dc1d8b62be8bc10c6d5d7346f5

SHA256
ae0cc0ed0e3b1187afb3fbb5b909258e2a87fe120902c03f4b327be9adf37cc3

SHA512
18cb3c20a7f5486acea3f0207f9fe99ce1e0727c827f3916749f96e47b4745eb0962ba82ec84843d046f3a0286019bca312255482be54a0b36748175733e0646

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe

Filesize
184KB

MD5
eeebd383f051c20aaada68c6415f3277

SHA1
fa71fee570ab674096e32f63b400fea7b9712f9d

SHA256
d7179ff02b75ba4d644f8ca7757ab7327f8e776a00c1d76700cdaad17b0267a8

SHA512
7b2038c4ee0c33e7f0f85ec272a20fe0b2c31334d26f81dd1ecde9eed48c2582335a63dd5ab1e1f14f49ff07a5608e12468d6aad549a6cf8b8f141e6f8d54027

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe

Filesize
184KB

MD5
191a3882689e9067f60493a91969556c

SHA1
9313ed0a5e220a51070f7cd3524940a19bd88a6b

SHA256
a0b2f0fb089d13176ce39c3ca820eef67cbf482733eec0e588f32a966c7e0543

SHA512
f37077d1cc424f76b8f2e69955fa9961023e4f8029f6eba44d123e4bf98f3329a20ab4455187f80a30bb325ec096fe36a68a23bc3988f6cf6eba19520f6b2beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49640.exe

Filesize
184KB

MD5
a58c0274541a01c5f2b02b60860bd5b0

SHA1
af25559636f4e8ed6101211a9726353238f32736

SHA256
b53327fe7c2109ce0e7af32a39263ed98637c4be9c5de649c13814e34c819ec5

SHA512
b41d458fec22662240b584d3135e46b6ac48027cd935906f8db19ae2310ac3ac0c905a16a07770496aadc56830df4cea74160c7acc3d51d310934c92f5fb2051

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe

Filesize
184KB

MD5
1e2b68db40fbeca315d66a876ed93f65

SHA1
359b29f2ad1522bbef9523915d1b22cdf167aa4c

SHA256
39ddae61537e51cf49f1c137f617e9091e3ceb03327da5701921b3675ef31a73

SHA512
8a540897f480734c0bc3cb9f76d711078f44aed526adf99afdb107ac757580ce3254b4b465cb0872093c0bd6bcd2b749c2d30cc20cf79f57996a05717bc11d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe

Filesize
184KB

MD5
af920d092e911ca0674e4f3d46bafff5

SHA1
2e5aed8e3f07a3cf582aaf97d6f1967512b7e09e

SHA256
52046fa5c06403bcb0451ed667ec9a8444c8097526083f7fa67b9a083223c924

SHA512
67e97b61686b53d9b3cace860ecf3996429391aafa40557502143ee07cc2aaa14498487eeb62e84c40a018f41c118c8ff79e77ccf3530fa0838dc485635b1c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54876.exe

Filesize
184KB

MD5
aaa53283c20212750988e2991cff1601

SHA1
2313d50d2846560c4814b19c31df5f0a5ace826b

SHA256
0129ffe0376e97082adeeac34d053d139ebf4d1019d1444cd45a0b48ae433ecb

SHA512
2950728f8d258a18a28bf887db9c6a45eeff4bfd98d570f1773b76cd9a741a8215ff631bd3a5732438e4a60aacf91d30a0885a88399cbd77778c541028b1c17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe

Filesize
184KB

MD5
61206f0336c5ccb354c59be5934e336b

SHA1
477bb3ebbe3a7e0e7b33d861f17c1a637b529d96

SHA256
66a24359990b070a2eed3249c955da23f759adc1531fc080f23935fb8a60b821

SHA512
6e69099a950cbe726fa208511c5394abe3abaef10c36c721cbedcf38d5f66047e89db1522519a95075f9a59114dea50837d0957123bfbe831c77c595e9ac6aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe

Filesize
184KB

MD5
485dd4537265779c20925ee5c9fa3748

SHA1
daab872a951df5f96d26a3215f20b14d82794a53

SHA256
89001f92bab317cd7e38e745e600f7b1e54a50d7f9330e479c0f3802e11ea44e

SHA512
f43a506ce080128a7ab6abbf5029b165a580c28e8d6eaff4dbd47d979533314a21fb86fdccfccfd08ad06dfcf80a05e3b430179c181180a627543447cd095860

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe

Filesize
184KB

MD5
13ffa4220433cc1d742ff2206b36a266

SHA1
1305dd9a1d316006224e315ab55301b4d8829609

SHA256
a371c8ff149d357370bcb9fd89432add76db27f0dc6eb5f9552b2e5751bdb990

SHA512
666fb4788fe2b02da8aafb6c97acbfdae77b16b2e99bc560e8b006b1b36f8481280e548e6fb386416f49e5471ba1ded9671746382fffd1a1bf39d0767d7503b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe

Filesize
184KB

MD5
295989cc68e33ba0560908bfc82be7ed

SHA1
8d7f8491f07295cc4eab3dc87b3e935907a701bf

SHA256
535bb4a9b3fa0d5041985e8bf42be2a608505de3212fbfbdc2f7182189c88643

SHA512
6c774fabe19503c9de910432828b95b60f3da31fee9904e1c6d9f27e37d338dc2228ce395933ee54cc6185bce6c50b9f76d28b4ff17226f997933c273c0916cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe

Filesize
184KB

MD5
66d0311824bd62075390b9caf6e4f7a0

SHA1
13c9f327fd4c1837a8a781f2610c33072ce154f0

SHA256
7456ee90ac894f07a8b7ec8f95f1b8de3886ca9e1dbf1bea2353fd8ee686048d

SHA512
d683ada718ff8b01b332f15595e4c6cf9e170a39dcc93ed9a0a01a311b38012d623521dbf1e355f78a2a63b7d09fa2b844f1e3cc3cb79d40af62cbf49d3dd8d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe

Filesize
184KB

MD5
af705dbc9d2d7f2306f956a7d832efac

SHA1
65b544e93842418dd4f37cac91676c20b39f5308

SHA256
a381696c4ae5088cb2c334a87c1c9aeeefb6e1a4918022a7ecc529c99fae45a8

SHA512
6f342c7fda3a5d5c1ec2ecb4168d06099bb47e4c40107bf4918eb650942b59dea8775b07ba94191e9bb75ab88a3db27f9e5b492b3744e580f54598eb9eed78b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe

Filesize
184KB

MD5
c84a911181ab1e60bcede559264bcc09

SHA1
6fe5a161937a3220b2ab79fe7bb7e04145e5320d

SHA256
47541c4a38449dd10cd44adaff4d68226b41d24f2321289f72948cc650e06f41

SHA512
095fb5b40d53b432593364cbfcaaf7b8d3e40548d3ccc840cde5fff5802d5f64a70f9c7c2644e2ab71f658dccdae04a6a47ddaffddfc43361526904b07314853

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads