cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe
Size

184KB
MD5

2089c780275edc17ee1c18054c7cf95a
SHA1

4193bc545abf506f9fb0b449013d493cd3b89a63
SHA256

cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841
SHA512

5e2986340bfb1ca389566d6027bf9ac56dd53c606cf36331ce6ef057c83f6e78108fa2041c947284e77ff7feb92b1578995894eb2a45eaf57790e80dc352f3b4
SSDEEP

3072:9AJkIDoRDWQXd5cNXErhpWfGlvMqnviuq:9ABoLN5cUhcfGlEqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4604	Unicorn-35610.exe
3892	Unicorn-14795.exe
1452	Unicorn-34400.exe
4172	Unicorn-1049.exe
1532	Unicorn-4732.exe
3244	Unicorn-56534.exe
4272	Unicorn-28768.exe
1376	Unicorn-40762.exe
2540	Unicorn-8208.exe
3104	Unicorn-2343.exe
888	Unicorn-30970.exe
936	Unicorn-24647.exe
2044	Unicorn-2464.exe
4824	Unicorn-47820.exe
4220	Unicorn-1888.exe
2368	Unicorn-21562.exe
4188	Unicorn-34447.exe
4708	Unicorn-48952.exe
1148	Unicorn-57617.exe
4696	Unicorn-46671.exe
1764	Unicorn-56982.exe
3620	Unicorn-11310.exe
2124	Unicorn-44294.exe
1796	Unicorn-51165.exe
4276	Unicorn-29575.exe
1288	Unicorn-48207.exe
2100	Unicorn-12732.exe
4892	Unicorn-58404.exe
3376	Unicorn-40427.exe
2584	Unicorn-7470.exe
3240	Unicorn-13500.exe
4236	Unicorn-44289.exe
3408	Unicorn-64154.exe
548	Unicorn-20661.exe
2072	Unicorn-40527.exe
3644	Unicorn-45237.exe
4076	Unicorn-61773.exe
3500	Unicorn-62255.exe
4672	Unicorn-29967.exe
2816	Unicorn-10101.exe
700	Unicorn-27357.exe
1752	Unicorn-11897.exe
4812	Unicorn-33941.exe
4224	Unicorn-15388.exe
2336	Unicorn-21519.exe
2908	Unicorn-21519.exe
4420	Unicorn-51675.exe
4480	Unicorn-23552.exe
4196	Unicorn-43153.exe
1016	Unicorn-27573.exe
2144	Unicorn-62141.exe
4264	Unicorn-3765.exe
3344	Unicorn-5753.exe
4948	Unicorn-9244.exe
2316	Unicorn-21981.exe
208	Unicorn-19712.exe
4404	Unicorn-52925.exe
3648	Unicorn-14606.exe
2640	Unicorn-14414.exe
2688	Unicorn-8560.exe
2808	Unicorn-50735.exe
1824	Unicorn-50635.exe
4048	Unicorn-42074.exe
4248	Unicorn-22208.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4424	1452	WerFault.exe	97
2704	1452	WerFault.exe	97
5256	4812	WerFault.exe	145
6148	5196	WerFault.exe	182
15096	5792	WerFault.exe	306
6480	16520	WerFault.exe	888
9396	12424	Process not Found	589
15548	16876	Process not Found	1015

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8032	dwm.exe
Token: SeChangeNotifyPrivilege	8032	dwm.exe
Token: 33	8032	dwm.exe
Token: SeIncBasePriorityPrivilege	8032	dwm.exe
Token: SeCreateGlobalPrivilege	10456	Process not Found
Token: SeChangeNotifyPrivilege	10456	Process not Found
Token: 33	10456	Process not Found
Token: SeIncBasePriorityPrivilege	10456	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe
4604	Unicorn-35610.exe
3892	Unicorn-14795.exe
1452	Unicorn-34400.exe
3244	Unicorn-56534.exe
1532	Unicorn-4732.exe
4272	Unicorn-28768.exe
1376	Unicorn-40762.exe
3104	Unicorn-2343.exe
2540	Unicorn-8208.exe
888	Unicorn-30970.exe
936	Unicorn-24647.exe
2044	Unicorn-2464.exe
4824	Unicorn-47820.exe
4220	Unicorn-1888.exe
4188	Unicorn-34447.exe
2368	Unicorn-21562.exe
4708	Unicorn-48952.exe
1148	Unicorn-57617.exe
4696	Unicorn-46671.exe
1764	Unicorn-56982.exe
3620	Unicorn-11310.exe
2124	Unicorn-44294.exe
1796	Unicorn-51165.exe
4276	Unicorn-29575.exe
1288	Unicorn-48207.exe
4892	Unicorn-58404.exe
2100	Unicorn-12732.exe
4236	Unicorn-44289.exe
3376	Unicorn-40427.exe
3644	Unicorn-45237.exe
2072	Unicorn-40527.exe
3408	Unicorn-64154.exe
548	Unicorn-20661.exe
3240	Unicorn-13500.exe
2584	Unicorn-7470.exe
3500	Unicorn-62255.exe
4672	Unicorn-29967.exe
2816	Unicorn-10101.exe
1752	Unicorn-11897.exe
700	Unicorn-27357.exe
4812	Unicorn-33941.exe
2336	Unicorn-21519.exe
4224	Unicorn-15388.exe
2908	Unicorn-21519.exe
4420	Unicorn-51675.exe
4480	Unicorn-23552.exe
4196	Unicorn-43153.exe
1016	Unicorn-27573.exe
2144	Unicorn-62141.exe
3344	Unicorn-5753.exe
4264	Unicorn-3765.exe
4948	Unicorn-9244.exe
2316	Unicorn-21981.exe
208	Unicorn-19712.exe
3648	Unicorn-14606.exe
2688	Unicorn-8560.exe
2808	Unicorn-50735.exe
4048	Unicorn-42074.exe
1824	Unicorn-50635.exe
2640	Unicorn-14414.exe
4248	Unicorn-22208.exe
4972	Unicorn-18447.exe
4916	Unicorn-63926.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4604	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	93
PID 4136 wrote to memory of 4604	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	93
PID 4136 wrote to memory of 4604	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	93
PID 4604 wrote to memory of 3892	4604	Unicorn-35610.exe	96
PID 4604 wrote to memory of 3892	4604	Unicorn-35610.exe	96
PID 4604 wrote to memory of 3892	4604	Unicorn-35610.exe	96
PID 4136 wrote to memory of 1452	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	97
PID 4136 wrote to memory of 1452	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	97
PID 4136 wrote to memory of 1452	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	97
PID 3892 wrote to memory of 4172	3892	Unicorn-14795.exe	102
PID 3892 wrote to memory of 4172	3892	Unicorn-14795.exe	102
PID 3892 wrote to memory of 4172	3892	Unicorn-14795.exe	102
PID 4136 wrote to memory of 1532	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	103
PID 4136 wrote to memory of 1532	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	103
PID 4136 wrote to memory of 1532	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	103
PID 4604 wrote to memory of 3244	4604	Unicorn-35610.exe	104
PID 4604 wrote to memory of 3244	4604	Unicorn-35610.exe	104
PID 4604 wrote to memory of 3244	4604	Unicorn-35610.exe	104
PID 3892 wrote to memory of 4272	3892	Unicorn-14795.exe	109
PID 3892 wrote to memory of 4272	3892	Unicorn-14795.exe	109
PID 3892 wrote to memory of 4272	3892	Unicorn-14795.exe	109
PID 1532 wrote to memory of 1376	1532	Unicorn-4732.exe	110
PID 1532 wrote to memory of 1376	1532	Unicorn-4732.exe	110
PID 1532 wrote to memory of 1376	1532	Unicorn-4732.exe	110
PID 4136 wrote to memory of 2540	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	111
PID 4136 wrote to memory of 2540	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	111
PID 4136 wrote to memory of 2540	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	111
PID 4604 wrote to memory of 3104	4604	Unicorn-35610.exe	112
PID 4604 wrote to memory of 3104	4604	Unicorn-35610.exe	112
PID 4604 wrote to memory of 3104	4604	Unicorn-35610.exe	112
PID 4272 wrote to memory of 888	4272	Unicorn-28768.exe	113
PID 4272 wrote to memory of 888	4272	Unicorn-28768.exe	113
PID 4272 wrote to memory of 888	4272	Unicorn-28768.exe	113
PID 3892 wrote to memory of 936	3892	Unicorn-14795.exe	114
PID 3892 wrote to memory of 936	3892	Unicorn-14795.exe	114
PID 3892 wrote to memory of 936	3892	Unicorn-14795.exe	114
PID 3244 wrote to memory of 2044	3244	Unicorn-56534.exe	115
PID 3244 wrote to memory of 2044	3244	Unicorn-56534.exe	115
PID 3244 wrote to memory of 2044	3244	Unicorn-56534.exe	115
PID 1376 wrote to memory of 4824	1376	Unicorn-40762.exe	116
PID 1376 wrote to memory of 4824	1376	Unicorn-40762.exe	116
PID 1376 wrote to memory of 4824	1376	Unicorn-40762.exe	116
PID 1532 wrote to memory of 4220	1532	Unicorn-4732.exe	117
PID 1532 wrote to memory of 4220	1532	Unicorn-4732.exe	117
PID 1532 wrote to memory of 4220	1532	Unicorn-4732.exe	117
PID 3104 wrote to memory of 2368	3104	Unicorn-2343.exe	118
PID 3104 wrote to memory of 2368	3104	Unicorn-2343.exe	118
PID 3104 wrote to memory of 2368	3104	Unicorn-2343.exe	118
PID 2540 wrote to memory of 4188	2540	Unicorn-8208.exe	119
PID 2540 wrote to memory of 4188	2540	Unicorn-8208.exe	119
PID 2540 wrote to memory of 4188	2540	Unicorn-8208.exe	119
PID 4136 wrote to memory of 4708	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	120
PID 4136 wrote to memory of 4708	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	120
PID 4136 wrote to memory of 4708	4136	cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe	120
PID 4604 wrote to memory of 1148	4604	Unicorn-35610.exe	121
PID 4604 wrote to memory of 1148	4604	Unicorn-35610.exe	121
PID 4604 wrote to memory of 1148	4604	Unicorn-35610.exe	121
PID 888 wrote to memory of 4696	888	Unicorn-30970.exe	122
PID 888 wrote to memory of 4696	888	Unicorn-30970.exe	122
PID 888 wrote to memory of 4696	888	Unicorn-30970.exe	122
PID 4272 wrote to memory of 1764	4272	Unicorn-28768.exe	123
PID 4272 wrote to memory of 1764	4272	Unicorn-28768.exe	123
PID 4272 wrote to memory of 1764	4272	Unicorn-28768.exe	123
PID 936 wrote to memory of 3620	936	Unicorn-24647.exe	124

C:\Users\Admin\AppData\Local\Temp\cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe
"C:\Users\Admin\AppData\Local\Temp\cbaa779cdc96bb992b71b172b899cd45a47923399a4cf12b26c4ef6f92397841.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
      4⤵
      Executes dropped EXE
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        8⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        9⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40463.exe
        10⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
        10⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        10⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        10⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        9⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        9⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        9⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        9⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        9⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        9⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        9⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        9⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14039.exe
        9⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        8⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45940.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
        8⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        8⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        9⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
        9⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        9⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        9⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        9⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        8⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        8⤵
        
        PID:16520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16520 -s 436
        9⤵
        Program crash
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        8⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        8⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        7⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        7⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42677.exe
        7⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
        7⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        7⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        9⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        9⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
        9⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        9⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe
        8⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        8⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        8⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19247.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        8⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        8⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        8⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        7⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        7⤵
        
        PID:18048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        7⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        8⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        8⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        8⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        7⤵
        
        PID:18428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40817.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41562.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe
        7⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        7⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        6⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe
        9⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        9⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        9⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        9⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        8⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        8⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        8⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51268.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        8⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        8⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29251.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12975.exe
        7⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        8⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        8⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        7⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61882.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        7⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        7⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        7⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28045.exe
        6⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        6⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        8⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        8⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        7⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
        6⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
        6⤵
        
        PID:18200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
        7⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        7⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        6⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        5⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        5⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe
        5⤵
        
        PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        9⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        9⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
        9⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
        9⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        9⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        8⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        8⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52800.exe
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37725.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        7⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        6⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 720
        7⤵
        Program crash
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        7⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        7⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
        6⤵
        
        PID:17636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
        6⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 720
        6⤵
        Program crash
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17244.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40463.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        6⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
        5⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        5⤵
        
        PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        8⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        8⤵
        
        PID:17660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        8⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        7⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        7⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        7⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        6⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47499.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe
        7⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        6⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45860.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59919.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exe
        7⤵
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
        7⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63326.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        5⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38845.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51546.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        6⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21216.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56794.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6608.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        5⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        5⤵
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5840.exe
        6⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
        5⤵
        
        PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        5⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        5⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        5⤵
        
        PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        8⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        8⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19632.exe
        7⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
        7⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51937.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        8⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        8⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        8⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        7⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        7⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        7⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        6⤵
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        8⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        8⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        7⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        7⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        7⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6979.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9497.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        6⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        5⤵
        
        PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        8⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        8⤵
        
        PID:18036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        7⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        6⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        6⤵
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51937.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
        7⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        7⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22464.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        6⤵
        
        PID:17068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        5⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        6⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        6⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        5⤵
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
        5⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:18412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8704.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        6⤵
        
        PID:17968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        5⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        5⤵
        
        PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46383.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23299.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        6⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        5⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
        5⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45768.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        5⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30488.exe
      4⤵
      PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
      4⤵
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        8⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        8⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        8⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        7⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        7⤵
        
        PID:17876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        7⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
        6⤵
        
        PID:17884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        6⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        7⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        6⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        6⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6834.exe
        5⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
        5⤵
        
        PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        5⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        7⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        6⤵
        
        PID:18008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        6⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17920.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60346.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        7⤵
        
        PID:17604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        6⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        6⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52923.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        5⤵
        
        PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
      4⤵
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        6⤵
        
        PID:17844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
        5⤵
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        5⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        5⤵
        
        PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6745.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        5⤵
        
        PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
      4⤵
      PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
      4⤵
      PID:14156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
      4⤵
      PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        7⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10754.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
        6⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        7⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        7⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36180.exe
        6⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
        5⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13047.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        6⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        6⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27962.exe
        6⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        5⤵
        
        PID:18164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        5⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        5⤵
        
        PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
      4⤵
      PID:14944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
      4⤵
      PID:17972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
      4⤵
      PID:9248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
    3⤵
    - Executes dropped EXE
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
        6⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
        6⤵
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        5⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62621.exe
        5⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        5⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        5⤵
        
        PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
      4⤵
      PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
      4⤵
      PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      4⤵
      PID:6216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
    3⤵
    PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
        5⤵
        
        PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
      4⤵
      PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
      4⤵
      PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
      4⤵
      PID:17084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
    3⤵
    PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
      4⤵
      PID:16536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7064.exe
    3⤵
    PID:9924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
    3⤵
    PID:12312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
    3⤵
    PID:15684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
    3⤵
    PID:7084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 720
    3⤵
    - Program crash
    PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 720
    3⤵
    - Program crash
    PID:2704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        9⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        9⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
        9⤵
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        8⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48157.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        7⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exe
        7⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        7⤵
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        7⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
        7⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        7⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        7⤵
        
        PID:18124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        7⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        6⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
        7⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        7⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31703.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
        6⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        7⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        7⤵
        
        PID:17684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        6⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47485.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
        5⤵
        
        PID:5792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 720
        6⤵
        Program crash
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13612.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
        5⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        8⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21731.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exe
        8⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
        8⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        7⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52472.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        6⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        6⤵
        
        PID:17508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        6⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6697.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe
        5⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59919.exe
        6⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe
        7⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        7⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        6⤵
        
        PID:18276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        6⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54316.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14739.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        5⤵
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        5⤵
        
        PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        5⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
        5⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        5⤵
        
        PID:18120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
      4⤵
      PID:12912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44946.exe
      4⤵
      PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe
      4⤵
      PID:7696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        7⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53147.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
        6⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61366.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40114.exe
        7⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        7⤵
        
        PID:17560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        7⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        6⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        5⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        5⤵
        
        PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        6⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        6⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        5⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56908.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        6⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
        6⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15362.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        5⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        5⤵
        
        PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        5⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        5⤵
        
        PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1573.exe
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
      4⤵
      PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62049.exe
      4⤵
      PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38131.exe
      4⤵
      PID:17220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
      4⤵
      Executes dropped EXE
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
        6⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        5⤵
        
        PID:13516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        5⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        5⤵
        
        PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
      4⤵
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        5⤵
        
        PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
      4⤵
      PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
      4⤵
      PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
      4⤵
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        5⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        5⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        5⤵
        
        PID:18248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12437.exe
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
      4⤵
      PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
      4⤵
      PID:11212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
    3⤵
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
      4⤵
      PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
      4⤵
      PID:18140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
    3⤵
    PID:8068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
    3⤵
    PID:13504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
    3⤵
    PID:17400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
    3⤵
    PID:6328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61799.exe
        7⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        6⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        6⤵
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        6⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
        7⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        6⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        5⤵
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50921.exe
        5⤵
        
        PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5430.exe
        6⤵
        
        PID:18392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        6⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
        5⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exe
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
      4⤵
      PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
      4⤵
      PID:8852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44289.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14595.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        6⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10306.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26940.exe
      4⤵
      PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
      4⤵
      PID:14448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
      4⤵
      PID:8864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
      4⤵
      PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        5⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        5⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        5⤵
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
      4⤵
      PID:13288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
      4⤵
      PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      4⤵
      PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
      4⤵
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
      4⤵
      PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      4⤵
      PID:9156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
    3⤵
    PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
    3⤵
    PID:10768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13577.exe
    3⤵
    PID:14040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16600.exe
    3⤵
    PID:17120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
    3⤵
    PID:9944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
      4⤵
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47249.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        5⤵
        
        PID:16936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36180.exe
        5⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        5⤵
        
        PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
      4⤵
      PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
      4⤵
      PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10877.exe
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
    3⤵
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        5⤵
        
        PID:11880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        5⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-86.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-86.exe
        5⤵
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
      4⤵
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
      4⤵
      PID:12280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
      4⤵
      PID:15748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      4⤵
      PID:16984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
    3⤵
    PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
      4⤵
      PID:14808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
      4⤵
      PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
      4⤵
      PID:9032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
    3⤵
    PID:9104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
    3⤵
    PID:12492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
    3⤵
    PID:16032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
    3⤵
    PID:6164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        5⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
      4⤵
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
      4⤵
      PID:17504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
    3⤵
    PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
      4⤵
      PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
      4⤵
      PID:16020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
      4⤵
      PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
      4⤵
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    3⤵
    PID:8472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe
    3⤵
    PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
    3⤵
    PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
    3⤵
    PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
    3⤵
    PID:6364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
  2⤵
  PID:4212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
    3⤵
    PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
      4⤵
      PID:13580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
      4⤵
      PID:15704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
    3⤵
    PID:8676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
    3⤵
    PID:11240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
    3⤵
    PID:5136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8815.exe
  2⤵
  PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40463.exe
    3⤵
    PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52001.exe
    3⤵
    PID:10548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
    3⤵
    PID:13508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
    3⤵
    PID:7204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
  2⤵
  PID:7620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
  2⤵
  PID:10788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
  2⤵
  PID:14136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35066.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35066.exe
  2⤵
  PID:17196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
  2⤵
  PID:8252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1452 -ip 1452
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1452 -ip 1452
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4812 -ip 4812
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5196 -ip 5196
1⤵
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5792 -ip 5792
1⤵
PID:14980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 16520 -ip 16520
1⤵
PID:18184

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe

Filesize
184KB

MD5
59fa3519b456cbb169e9418eeb0078b0

SHA1
831fa8dffbe23d3312476b10d2de080426c9716c

SHA256
a2a2edc9b165e000da600b438a5fbfad425ab7c31175398f3c6b71672fff60c1

SHA512
0ac7f0f06fdb93672b4cb1dcecc987de8edc4fc8f3055010d47b0be042d4e65c0f64f1e2d4979e95168933ca070739c1e7d2e6d653d517e9a75d0bd04bacc1a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe

Filesize
184KB

MD5
a75aa5638688e026d9953eaa42f52143

SHA1
8fa50c425fc8ae1092ca7688c2d329fc134c7d0d

SHA256
ae7abfef69a4cd453ed3fe1e07ac31ceb16e5353e6a0dd963b6694c6d5f7f27f

SHA512
43bacc627da706d91a92b1cbfaaedc6a801e79a1d0c757c8e1d388077845f3b467075eca3678b4deb14d138a36db35fb930495b0c708eabcbd4931078b817d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe

Filesize
184KB

MD5
2550253ba118f6f29068483f8a1a5924

SHA1
f549d82a798a55eefe9dc17314d7e2ea3d49e5c4

SHA256
beb207feeed700a7d085d7e6d6bf2ab24a8e39fe6fc560025947c4a069bdf706

SHA512
6d8c65fec6ffd5abd4deaee84779087b7535e7a686df0b2d5d96cf4ee8304c027320658364a84d66ce89b00fc4041624534f79f887dcfec76fa314a6fd56c73b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe

Filesize
184KB

MD5
22603d49af25063b8303dcc662383c2d

SHA1
89e4b64c30809b3faca5aa8cbc0811fc43ac1291

SHA256
6f1de845f658eee7605ebd2e80680d21f4fc565505c01238031de21a6548f1bc

SHA512
edc51f6e47a423c210b9db46f8e2e70bcd67d534f39eb4d29b16bb89d779572d1fecfd33f6079c4a997fab804815137d9932b9377dd97d319d711baa2717094c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe

Filesize
184KB

MD5
0ee6425368e4e2b1201ae74c1583fca6

SHA1
522fc627a5e403eab2dc46d457899665ca497779

SHA256
105b89451d045f16755eaaeda2a67c1f5711b0cef718a03ec8870f4815133451

SHA512
e9308071cd46f68f1d050bd35fe2306851fef8f64f398bc65e0e5089755f6b575fbdfe8c7a3574225f99e63ad64ac00d3032330a8c5bf715ab994b428442b650

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe

Filesize
184KB

MD5
b40b6552bf8abc9396d1c2ba7655ab0f

SHA1
bb5c674a6ad61f80f99df251993c65e2f5c6d965

SHA256
70ddd31336d07ff017fa5f478541a20ef4b3ddae4b1c0aa4dacc4c16422b5c3a

SHA512
3ea99646aba90a154752af189df2922a7c237e1fc827d80af3406be609bc806c8d87396e71430939a6e6c4520ff208a3392a18c6f88120c6a9dabbfa36895fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe

Filesize
184KB

MD5
661950c49f45aebded58bad92816f089

SHA1
f85dcd6bc41003eb4a78ff73d19ffd6253c1d9c9

SHA256
3c06ceffbece084b02caabfeff57037655cc2505f74cda6fca048e5a7a04c508

SHA512
f2e4f2aa60a3ce24520a1d7d80315b546dcaf5ed3fa1fd8ac39059db16d06ae6045432f1e38f0a395d66ed26a4dae5a715535d192a90cd9bbc9fa4fe7fbdba8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe

Filesize
184KB

MD5
63813a55492e1a4150af6445fd922793

SHA1
6366e766337a8437bf638027430094da6537277e

SHA256
40a3c18db05cd160574a76e3fe18071c0a364a01e4bb22fd467b9fd7e5fd8d34

SHA512
083c2b7982bcfb34431c6818267a39108111163ed72707219be9197206959b313b84bf37634a81c707866edf6cd3b36b6c90b0607316f49e668281ad8908e598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe

Filesize
184KB

MD5
6c99d6c2c34a90ef46261f89d0659b68

SHA1
a9688698d7832767fb2d038f5b9be7f55095af2f

SHA256
2711836eb8ddd27011a0e103163dfbe5b4e0360814e7292b1f0c06509043445e

SHA512
535166a619c100fa2607c03aa1788d336acd8a1659577b29e777157793662d8400258c53ef8c6aa100d63e5be8203a0a10c16149bcc922f123907d0afee767ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe

Filesize
184KB

MD5
9c7a5fc5546f541d19198aba94daf6c7

SHA1
44162f45b542df9be929141fd8abda47dcfd516e

SHA256
b9a5e06d08188ce94059436e126855ecc176c548b20777e91ef6dbe6048ccaa0

SHA512
484e8a0c334acdda2451cf03eb604a0e2bb81f9ff3c501f6e9ae3dc439b122d121e3889ef03ba1085f30a5e18e4f4ee8a284107e8f1d99429dd39e86e28347ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe

Filesize
184KB

MD5
55381102b33dbc57d3ce87dff43f3644

SHA1
dea1705b5bdb9a569439c68431546b0988a0a808

SHA256
d8719f8c31964865427da0916eeee0eb856a3cad350537c699f89482cd64c4a1

SHA512
8cba6ca16833b51f161b00b8e32431552f1dc2c37e728fd8b300eb63e3c251f83549932b907ed3d3c262a61990ca482106f346bb945868e26e9cf7f2608bc6b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe

Filesize
184KB

MD5
4420cf6936e6d01b79a13abb4c6380aa

SHA1
3d37180ddab343b26af4e7c8b5a05e707b0b5cc9

SHA256
55e3f4ac5f4afc094ddf27cc26bf7819a24d3d1d6179e46662f2caaa5bf9dd24

SHA512
bd822d24aaaa918910850f6cbeb7b6b94288728fe8f138c65b85657b4581972b262e529be2c755f29741180d4c22b3319da121512236923dae3fc78156f7c27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe

Filesize
184KB

MD5
9d5f2f155cd0b1421ddd66fcf44f89d7

SHA1
e591600e7fb244127272c63950e1bb8ebfbcb8f8

SHA256
e4e837e10e3b8aba2205f9e5b00d961c41d66b123a7f6e56e06ce16abc60c0ed

SHA512
8613f42c687a96aa0d1f427c64efabcd7d45b8beabc3f77080eb1e3d0d47ff047b4f3626ec3f2fb8b1df93c0c86f54d2c0a6e76299e244f03d6861493b53bd76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe

Filesize
184KB

MD5
6bab9bf9c65f7ca4ddff95e67c502ade

SHA1
04d3b96f80ecfb2929fa7b7bf91722f6ef8dcec8

SHA256
4158fe4951f744bfa6d61d54d502ad8e59c259bbc4660d3277d5c626c3d76ee4

SHA512
efc9e767aa03c32a93e8edf7f6d4c498f6d2159a2114f09aea07ddc2e2a222c79bbb939f108d6f686b2eaaf06fdcf3dc9742b23d3e3b47bba7e58633d2398f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe

Filesize
184KB

MD5
e4320ab5353d6a4d03faa331d8da23c0

SHA1
bcdc42bb9be5c36ac69d8f01bfdd1072f700555f

SHA256
e071b5b4eab1dcd57982c1b0b0eb503c8a767e1eaeb425bf2091289578645137

SHA512
105a3348d95a725669eeaaa498c3d3b11865663467ff8cc764b48e56e05d87659655520ccb57cb94851ba0d7f72d92e5b391e317f4a2d2097ec753dbe3db3509

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe

Filesize
184KB

MD5
843a304703c99b5e9f195c723dfb9c47

SHA1
2ac09bb5f34c96dbb692bcb4961da219e50da594

SHA256
16ceb688207e142fd36d5dcf6c74f03cee52c0d65317143d22925fb66f32f3d8

SHA512
15c8b5af37558a8de7c4a6755e98e2316165803c0c94143a04e34c03381a13190ff397ed3ee59824b08cfcaf736b661de4f09c85c3b2646165f8bb0b9f343c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe

Filesize
184KB

MD5
2c8312241c3c63f35173889997d53560

SHA1
4bbe22a52feda0babd81c856e464b6c8974bd28f

SHA256
2bbedb33c099bdebdb41ee2db38f86f8af62cce9e47384156226894baeb985d5

SHA512
dbbe1ce24a092ca58ed76b9db3603c9f20e1a2f5a960e4838ceba0218ea0d9d34e686cd1e016dca91bc19006305c882c76d74393eb8fd5e181640c0f1ff886bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe

Filesize
184KB

MD5
20523534a1317b43c6e87d3b68f662d8

SHA1
71fda7579c3689fee0a675850d28c60dd1889b1a

SHA256
a03c0af45247e05cd96faf72abd5553c2df5f91eb7d1c99dfc84acc7bbf0ee79

SHA512
ef09a8b10ba6477f60b678eda380643b75d02253d5ce5d1d900b7caa310ff677ee0f6619a8055a7155ee6ecc6a39af55b2a3a3ea1538f06cc16f5981cfcf3f9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe

Filesize
184KB

MD5
38ad4a02a50532a111ce9fe81d20d0b3

SHA1
5ed2f93196bbfa8a15aeb466d6a97cd7bbd34799

SHA256
8e2505fc8609eb1cb3e385559d96bb4c076451a3a24d4cd5baaa58326696184f

SHA512
be56d66e94df2b5bca698f56726ce9087586c0da7e10f389f6e7658e8df47279df2aff7cb45144c344e72a9aa76aeecfb387e1b99e80e7b41b6f987726101d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe

Filesize
184KB

MD5
44d7a5531c6ebbb050fa4e156fb66631

SHA1
e74e33b193c764ced1048c4f7a278ff759ed8188

SHA256
6885e88f0e3db322b5353e6895adf60a4ca96061081f6c69cb16dc10346fe106

SHA512
e164c92315f736664c5fc6216147fbe8dafae68d83c16e1efe25b3776b92741851c52e804e89708cc7b79106fdcbf610485f114060a1cac204270d0027d20696

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe

Filesize
184KB

MD5
207af74d6c7d47bf23af1058c00be9e4

SHA1
3c90dd87e9d968e1840230fb7b1dea74e5cf786f

SHA256
4c035232d0b5aeb6f8f17f6945a63c10c95d43e0ee622410ba3c1448a8c8ed0e

SHA512
e90a02f60df8c4a69d9a20ecf35c0688a0c24b3992104fab6e4d9858a52a51fa0e56fabcecc13ee4f90b3f9a20f8ead20ecc97a443bd79e7c24c88f2802a3d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe

Filesize
184KB

MD5
2930629f7360830cefb995b2aa4dbed0

SHA1
3adf587afefa08cd9e7567f3b6737f8ba5dbf511

SHA256
a1b3a05d6a8c49dcfdae53fe2bc9f5c4d701446d43c3349d680b04beefd123e2

SHA512
1b0cfb7e2d8d6371fa771369aafc58b49ebeb797e705872fabdeeae04817a83e1660110e88a3c60e7e6b93da3390ed914ec1f07b5247be75a8a806e7e97b69cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe

Filesize
184KB

MD5
cadac10bf54e6c079132fb382a81d63d

SHA1
c3a0b64d7e0bd429f82c23b2143535fd50529fb1

SHA256
0dc4ac93bb970def99c5317a714206ad1d53f351a44ebdf71bd56d84245caed4

SHA512
bf2bcc4455b9f4c351bfc3e6424ab62a852ed75e73ba4faba2157db7ba78b4f0c2a37475e6d0d70869d1782c537d5bac077f8f3369b4e7fa988c3a8f0c1e60de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe

Filesize
184KB

MD5
b3b16c52e4c2f659f34e223963d204b8

SHA1
61e7dbe6f00ee2015dc3dcb8b968aa01d6d02aee

SHA256
b198de77d17299ed19495ed852755d0e8a237fba302007ccc6c806bff8297b8e

SHA512
a958b12e4609e2adc57a4ad11f4e6f9b51dc4ac028592f18c936d380af96fe53e5a5dbf2e9618b8154954707a42b8d1d5a8d94ba91c24ce83542505724817d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe

Filesize
184KB

MD5
e53e6c8eeb41bd96791e655d028f0be0

SHA1
e32493a14da0617e1f6dcdaec99d3bfea313537b

SHA256
b4d9e30dba8434a683d358908502a9673a436c6f27df0c3553295745f4d390a7

SHA512
089fd85271eec105945dfd67f5e20c49e2f7ae6a4f55ca8113bfc4ed7a566f63cd7bf15a91a2ad654a8f5998f74388ebf0352c501bc3255a85e505bedced6449

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe

Filesize
184KB

MD5
8a46be3f228a8faf10f04e82a5663741

SHA1
e4e66f02b1679b3954722137f89810dbe2454e0b

SHA256
30496a11bd975f00bf63450005d265b077f732c3e6981b11247ab273be8f49d2

SHA512
6611bd216552fc853509e172401c999a7519db1bdbc4ce960e371127fb1cb5693d973d3bcc6d8fdc66022843686774d2a992e58f215e11627bdfe7fd41b46a9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe

Filesize
184KB

MD5
943a06236f0affc51cd881c7f524177e

SHA1
a6922530f0a1cbfb32bd7f06aac464203ee33c79

SHA256
500cee516caeb5f4916d570ef84d44fee33e70f39164d9eea50427cc13dafec8

SHA512
0ea444e52f595650b2527ba8f8715e19cb877b88bc8da2bbe35f922999019018f4bb4f5eafd05d465ca1bba22aeff47dd23aee20fe9b73e1491a5fa64a2d008f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe

Filesize
184KB

MD5
e256fb403bfa77adc4fe4107ac12cfa0

SHA1
ad2c63a16fcbd71ba10f746e12766e36db5e5b6b

SHA256
b0359fad434051e88609f41f5b2af27a8d35984cebceb19ee0804c31d0ffb462

SHA512
c8b4cf5b3257edccb19be4e113a3aecdfbddf9a91bc0735158f4f8b552ce904b6bafe9f407737dc20dc2ffa3bdcc0251c7c5e6af6c30e62b06e376d7a268fd6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe

Filesize
184KB

MD5
be8232bb8eba7599f90324dbdbc3c0d1

SHA1
01506e151e429a93a05e827cc7f44093f7e951fd

SHA256
c3cb708df2e4bdfbd55dbcfedc9416472fd9be2ea9902f55740826a366e791f0

SHA512
d922abbdb660913f03916231dd3c2ce38032fcaf9aeab3625215f2ad83599077ed02bc165f03c0d6cbab0716e4aacb030c7440b6c1bf295d1445a82b554c2e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe

Filesize
184KB

MD5
88e2a5e1de27a64c299f06dd70d1ba51

SHA1
e5d401a813b3ec3797b1474fd4dbb21be0862606

SHA256
228e6d4159ecc47554d90cfd6d0bb762f3acfc05e9872739178a501e76f3cb52

SHA512
339ef1d85c3d37d499c4551b1238e5dbba969d9de7b9a85f4996565b6e222f2235e6509c86b410c4ab330db5806181507f0f6c64e7cee9d2b4997e731bfecfc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe

Filesize
184KB

MD5
9483732e6c499eac4ed609eef9974c21

SHA1
c600858b7770c262d5a0496d84e8685d326960c0

SHA256
ad3db9598220eaae7f50c89070fdfdf068fc1027ed457e1c91e45df1b67d7709

SHA512
908a23a5bc52f857ec8f71fb59ef3296d704af00a3770ace0ed582e189d99ac4f80974f1764c38a421822065d2757c925e2a05c108aee1c56f9af01cfcd4bd40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe

Filesize
184KB

MD5
7543627e4a294c02bf3424e64b46defc

SHA1
dddd9b817f46063632a0fb44f8f43192ac6d3315

SHA256
0dc807db69d91b006cc7fe5122a8f438a17eb4297a176fff11ea62588c499f84

SHA512
ba44715db6fa259d98d9bbedbbc08fcfefa9aac01717ccf48e19a2556afb8902fac7f389c182baad7259d08c1ba7debb9880f6250a876775591d56beb8614331

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe

Filesize
184KB

MD5
95b81561d2cbe554e294c9e2324d215b

SHA1
0b035ea11f0298bf6157755f4cf54595cd3646e7

SHA256
9e8818625fe8512b37efe2eeb65cf4d5e81de707f198114f6bf6c2a1bea029c1

SHA512
4d765ed1076f1dccf65f6070073446a0fde40a9438b3205469f44b499774c7e61582ec99f048d1807a47f1ca911107192e1878112331fc91c71cf5a794cb57e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe

Filesize
184KB

MD5
4a90ab6e4a9be82c246c8683301cc085

SHA1
40b3e6ff18cc84f25813e3211c6079a351c4e9a6

SHA256
e753255c0926d2fbc5b970eb5798682342b13d91f96df862c5fa56895ea411af

SHA512
2ea4b96a2ad044f2b3b2010a9128765a4d9bccb5b256ab423bed7b3a554c5fb66da31c1d7c2bdb84fede89ff7469bf13fc8d3ad7da00029c3963608c07c8d0be

Download Submit
memory/9888-3924-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads