7a9c5b05d7d262ebdc5a5aebbf7253ad3da2b497afa29e8b9269c227894d98b8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe
Size

184KB
MD5

5178d19ce63453f090a5b771088b4920
SHA1

9cbd95dc319d63dc0da2462087818c08de54d9d6
SHA256

7a9c5b05d7d262ebdc5a5aebbf7253ad3da2b497afa29e8b9269c227894d98b8
SHA512

09ca5ba3e740b97a3232faa36114a57f1efbff6d3b59ec471a85f01626c4266833b0b44f4fb84ca093c1b6ec5a9312c77d97f2fb6a9c1987c48bb9b8e5d67ffb
SSDEEP

3072:Z541ClonKkWQfp6KQHEz2Q29lvnqnviuN:Z5Ro0up6AzT29lPqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1716	Unicorn-42893.exe
3888	Unicorn-6476.exe
4812	Unicorn-19283.exe
1336	Unicorn-58765.exe
1720	Unicorn-9372.exe
2792	Unicorn-55044.exe
2944	Unicorn-35915.exe
4256	Unicorn-11884.exe
3260	Unicorn-24691.exe
4704	Unicorn-11500.exe
4492	Unicorn-27645.exe
3464	Unicorn-24115.exe
628	Unicorn-37851.exe
3684	Unicorn-10851.exe
4936	Unicorn-37571.exe
4452	Unicorn-15933.exe
1400	Unicorn-65133.exe
224	Unicorn-42283.exe
4348	Unicorn-28547.exe
1184	Unicorn-48029.exe
3104	Unicorn-27971.exe
556	Unicorn-63981.exe
4620	Unicorn-63981.exe
2104	Unicorn-34189.exe
4592	Unicorn-34189.exe
444	Unicorn-27674.exe
964	Unicorn-33540.exe
2188	Unicorn-13939.exe
1524	Unicorn-24874.exe
3992	Unicorn-58029.exe
1940	Unicorn-19034.exe
3896	Unicorn-53517.exe
3384	Unicorn-33459.exe
3096	Unicorn-56205.exe
4624	Unicorn-3283.exe
4316	Unicorn-55821.exe
1764	Unicorn-22957.exe
2068	Unicorn-16826.exe
2512	Unicorn-55172.exe
2368	Unicorn-16442.exe
4664	Unicorn-5852.exe
3812	Unicorn-25587.exe
3240	Unicorn-60445.exe
2960	Unicorn-27581.exe
2840	Unicorn-46989.exe
4708	Unicorn-30461.exe
404	Unicorn-43267.exe
2388	Unicorn-30269.exe
3292	Unicorn-53620.exe
5100	Unicorn-53627.exe
4632	Unicorn-13548.exe
4008	Unicorn-28852.exe
2316	Unicorn-29117.exe
3672	Unicorn-61332.exe
3856	Unicorn-15395.exe
556	Unicorn-9251.exe
624	Unicorn-22986.exe
1300	Unicorn-43844.exe
1532	Unicorn-59988.exe
1104	Unicorn-20979.exe
2596	Unicorn-7212.exe
2976	Unicorn-19635.exe
672	Unicorn-24893.exe
4072	Unicorn-20298.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
3632	4620	WerFault.exe	117
2384	556	WerFault.exe	116
6984	5536	WerFault.exe	188
5740	4904	WerFault.exe	166
6756	5512	WerFault.exe	187
8608	7452	WerFault.exe
11984	11076	WerFault.exe	495
19228	15036	WerFault.exe	775
19220	15160	WerFault.exe	783

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe
1716	Unicorn-42893.exe
3888	Unicorn-6476.exe
4812	Unicorn-19283.exe
1336	Unicorn-58765.exe
1720	Unicorn-9372.exe
2792	Unicorn-55044.exe
2944	Unicorn-35915.exe
4256	Unicorn-11884.exe
3260	Unicorn-24691.exe
4704	Unicorn-11500.exe
3684	Unicorn-10851.exe
4492	Unicorn-27645.exe
3464	Unicorn-24115.exe
628	Unicorn-37851.exe
4936	Unicorn-37571.exe
4452	Unicorn-15933.exe
1400	Unicorn-65133.exe
224	Unicorn-42283.exe
4348	Unicorn-28547.exe
3104	Unicorn-27971.exe
1184	Unicorn-48029.exe
4620	Unicorn-63981.exe
556	Unicorn-63981.exe
2104	Unicorn-34189.exe
1524	Unicorn-24874.exe
444	Unicorn-27674.exe
964	Unicorn-33540.exe
2188	Unicorn-13939.exe
4592	Unicorn-34189.exe
3992	Unicorn-58029.exe
1940	Unicorn-19034.exe
3896	Unicorn-53517.exe
3384	Unicorn-33459.exe
3096	Unicorn-56205.exe
4624	Unicorn-3283.exe
1764	Unicorn-22957.exe
4316	Unicorn-55821.exe
2368	Unicorn-16442.exe
2068	Unicorn-16826.exe
4664	Unicorn-5852.exe
2512	Unicorn-55172.exe
3812	Unicorn-25587.exe
2388	Unicorn-30269.exe
4708	Unicorn-30461.exe
2960	Unicorn-27581.exe
404	Unicorn-43267.exe
2840	Unicorn-46989.exe
3240	Unicorn-60445.exe
3292	Unicorn-53620.exe
5100	Unicorn-53627.exe
2316	Unicorn-29117.exe
4008	Unicorn-28852.exe
556	Unicorn-9251.exe
4632	Unicorn-13548.exe
3856	Unicorn-15395.exe
3672	Unicorn-61332.exe
624	Unicorn-22986.exe
1300	Unicorn-43844.exe
1532	Unicorn-59988.exe
1104	Unicorn-20979.exe
2976	Unicorn-19635.exe
2596	Unicorn-7212.exe
672	Unicorn-24893.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 1716	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	90
PID 244 wrote to memory of 1716	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	90
PID 244 wrote to memory of 1716	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	90
PID 1716 wrote to memory of 3888	1716	Unicorn-42893.exe	93
PID 1716 wrote to memory of 3888	1716	Unicorn-42893.exe	93
PID 1716 wrote to memory of 3888	1716	Unicorn-42893.exe	93
PID 244 wrote to memory of 4812	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	94
PID 244 wrote to memory of 4812	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	94
PID 244 wrote to memory of 4812	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	94
PID 3888 wrote to memory of 1336	3888	Unicorn-6476.exe	97
PID 3888 wrote to memory of 1336	3888	Unicorn-6476.exe	97
PID 3888 wrote to memory of 1336	3888	Unicorn-6476.exe	97
PID 4812 wrote to memory of 1720	4812	Unicorn-19283.exe	98
PID 4812 wrote to memory of 1720	4812	Unicorn-19283.exe	98
PID 4812 wrote to memory of 1720	4812	Unicorn-19283.exe	98
PID 1716 wrote to memory of 2792	1716	Unicorn-42893.exe	99
PID 1716 wrote to memory of 2792	1716	Unicorn-42893.exe	99
PID 1716 wrote to memory of 2792	1716	Unicorn-42893.exe	99
PID 244 wrote to memory of 2944	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	100
PID 244 wrote to memory of 2944	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	100
PID 244 wrote to memory of 2944	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	100
PID 1336 wrote to memory of 4256	1336	Unicorn-58765.exe	102
PID 1336 wrote to memory of 4256	1336	Unicorn-58765.exe	102
PID 1336 wrote to memory of 4256	1336	Unicorn-58765.exe	102
PID 3888 wrote to memory of 3260	3888	Unicorn-6476.exe	103
PID 3888 wrote to memory of 3260	3888	Unicorn-6476.exe	103
PID 3888 wrote to memory of 3260	3888	Unicorn-6476.exe	103
PID 2792 wrote to memory of 4704	2792	Unicorn-55044.exe	104
PID 2792 wrote to memory of 4704	2792	Unicorn-55044.exe	104
PID 2792 wrote to memory of 4704	2792	Unicorn-55044.exe	104
PID 2944 wrote to memory of 4492	2944	Unicorn-35915.exe	105
PID 2944 wrote to memory of 4492	2944	Unicorn-35915.exe	105
PID 2944 wrote to memory of 4492	2944	Unicorn-35915.exe	105
PID 4812 wrote to memory of 3464	4812	Unicorn-19283.exe	106
PID 4812 wrote to memory of 3464	4812	Unicorn-19283.exe	106
PID 4812 wrote to memory of 3464	4812	Unicorn-19283.exe	106
PID 1716 wrote to memory of 628	1716	Unicorn-42893.exe	107
PID 1716 wrote to memory of 628	1716	Unicorn-42893.exe	107
PID 1716 wrote to memory of 628	1716	Unicorn-42893.exe	107
PID 244 wrote to memory of 3684	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	108
PID 244 wrote to memory of 3684	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	108
PID 244 wrote to memory of 3684	244	5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe	108
PID 1720 wrote to memory of 4936	1720	Unicorn-9372.exe	109
PID 1720 wrote to memory of 4936	1720	Unicorn-9372.exe	109
PID 1720 wrote to memory of 4936	1720	Unicorn-9372.exe	109
PID 3260 wrote to memory of 4452	3260	Unicorn-24691.exe	110
PID 3260 wrote to memory of 4452	3260	Unicorn-24691.exe	110
PID 3260 wrote to memory of 4452	3260	Unicorn-24691.exe	110
PID 4256 wrote to memory of 1400	4256	Unicorn-11884.exe	111
PID 4256 wrote to memory of 1400	4256	Unicorn-11884.exe	111
PID 4256 wrote to memory of 1400	4256	Unicorn-11884.exe	111
PID 3888 wrote to memory of 224	3888	Unicorn-6476.exe	113
PID 3888 wrote to memory of 224	3888	Unicorn-6476.exe	113
PID 3888 wrote to memory of 224	3888	Unicorn-6476.exe	113
PID 1336 wrote to memory of 4348	1336	Unicorn-58765.exe	112
PID 1336 wrote to memory of 4348	1336	Unicorn-58765.exe	112
PID 1336 wrote to memory of 4348	1336	Unicorn-58765.exe	112
PID 4704 wrote to memory of 1184	4704	Unicorn-11500.exe	114
PID 4704 wrote to memory of 1184	4704	Unicorn-11500.exe	114
PID 4704 wrote to memory of 1184	4704	Unicorn-11500.exe	114
PID 2792 wrote to memory of 3104	2792	Unicorn-55044.exe	115
PID 2792 wrote to memory of 3104	2792	Unicorn-55044.exe	115
PID 2792 wrote to memory of 3104	2792	Unicorn-55044.exe	115
PID 3684 wrote to memory of 556	3684	Unicorn-10851.exe	116

C:\Users\Admin\AppData\Local\Temp\5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5178d19ce63453f090a5b771088b4920_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        9⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe
        9⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        9⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        9⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
        9⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        9⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        9⤵
        
        PID:17984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        8⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        8⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32159.exe
        8⤵
        
        PID:18984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        8⤵
        
        PID:18444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36751.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        7⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 632
        8⤵
        Program crash
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62424.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        8⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        7⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        8⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        7⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        7⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45261.exe
        7⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
        7⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        6⤵
        
        PID:19176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        9⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        9⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exe
        9⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        8⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        8⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        7⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        7⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        6⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        7⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        7⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        7⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        7⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        6⤵
        
        PID:18268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        8⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        8⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        8⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        7⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        7⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        7⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        7⤵
        
        PID:18596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8391.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        6⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
        6⤵
        
        PID:18368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        7⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        7⤵
        
        PID:16872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        6⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        6⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15036 -s 464
        7⤵
        Program crash
        
        PID:19228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        6⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12880.exe
        5⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        5⤵
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37981.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        9⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        10⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        10⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        10⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        9⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        9⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        9⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        9⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56007.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        8⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11076 -s 464
        9⤵
        Program crash
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        8⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        7⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        7⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        8⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        7⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        8⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        8⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        7⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        6⤵
        
        PID:17476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        6⤵
        
        PID:18716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
        8⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6037.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
        6⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        5⤵
        Executes dropped EXE
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46424.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        7⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
        5⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57834.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        6⤵
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40456.exe
        5⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
        6⤵
        
        PID:19108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        5⤵
        
        PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
        5⤵
        
        PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        6⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        8⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26161.exe
        8⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        8⤵
        
        PID:17452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        7⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        7⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        7⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30844.exe
        7⤵
        
        PID:17752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        6⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        6⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48852.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        7⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
        6⤵
        
        PID:18352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        6⤵
        
        PID:19352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        5⤵
        
        PID:13792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43860.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe
        7⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        6⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        5⤵
        
        PID:7452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 464
        6⤵
        Program crash
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      4⤵
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        6⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        6⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        5⤵
        
        PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34576.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
        5⤵
        
        PID:14956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        5⤵
        
        PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exe
      4⤵
      PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
      4⤵
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
      4⤵
      PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
      4⤵
      PID:17384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        9⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        9⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        9⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        8⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exe
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        8⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        8⤵
        
        PID:17784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32407.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        6⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        8⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        8⤵
        
        PID:15160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15160 -s 464
        9⤵
        Program crash
        
        PID:19220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53926.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26832.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        7⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
        7⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        7⤵
        
        PID:18552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20869.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43860.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        8⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        7⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        7⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        6⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        6⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        6⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        7⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        7⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59409.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31238.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41741.exe
        5⤵
        
        PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58145.exe
        7⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
        8⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        7⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        7⤵
        
        PID:19148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15177.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        7⤵
        
        PID:16600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42680.exe
        6⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        7⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        6⤵
        
        PID:17564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        7⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30844.exe
        7⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe
        7⤵
        
        PID:18772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        6⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30593.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29943.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
        5⤵
        
        PID:18376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18173.exe
        5⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        7⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        7⤵
        
        PID:18360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        7⤵
        
        PID:17820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12423.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        5⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        5⤵
        
        PID:18872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49428.exe
      4⤵
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        6⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62920.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64381.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23894.exe
        5⤵
        
        PID:18808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
      4⤵
      PID:12492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
      4⤵
      PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      4⤵
      PID:16696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4620
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 688
        5⤵
        Program crash
        
        PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        6⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        5⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        6⤵
        
        PID:18384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
        5⤵
        
        PID:16584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17360.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        5⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28540.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
      4⤵
      PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58072.exe
      4⤵
      PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        5⤵
        
        PID:17968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
      4⤵
      PID:13928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
      4⤵
      PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
      4⤵
      PID:19128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        7⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        6⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exe
        6⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        6⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exe
        5⤵
        
        PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
      4⤵
      PID:5536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 488
        5⤵
        Program crash
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62753.exe
      4⤵
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
      4⤵
      PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
      4⤵
      PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
      4⤵
      PID:9168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6697.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52582.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30001.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43533.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53290.exe
        5⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13852.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52024.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      4⤵
      PID:12980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
      4⤵
      PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
      4⤵
      PID:16552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        5⤵
        
        PID:16592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
      4⤵
      PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
      4⤵
      PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
    3⤵
    PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
      4⤵
      PID:13844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
      4⤵
      PID:5848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
    3⤵
    PID:9284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34968.exe
    3⤵
    PID:14276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
    3⤵
    PID:6052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9372.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58029.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        8⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45261.exe
        8⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        7⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12396.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63073.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        6⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65514.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        7⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        7⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        6⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20151.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        5⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        5⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        7⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        7⤵
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        6⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        6⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        6⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        5⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        5⤵
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15395.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        7⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        6⤵
        
        PID:17420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        6⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        5⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        5⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
        5⤵
        
        PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54987.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        5⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
        5⤵
        
        PID:17584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
      4⤵
      PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42415.exe
      4⤵
      PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
      4⤵
      PID:13444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        7⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        6⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
        7⤵
        
        PID:19272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        6⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        6⤵
        
        PID:18732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        7⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        5⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6736.exe
        5⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        5⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
        5⤵
        
        PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57787.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        6⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
        5⤵
        
        PID:16560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        5⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        5⤵
        
        PID:19292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
      4⤵
      PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        6⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28540.exe
        6⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63409.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        5⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        5⤵
        
        PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44052.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37344.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
      4⤵
      PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
      4⤵
      PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
      4⤵
      PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56932.exe
      4⤵
      PID:17000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4954.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        5⤵
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        5⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
      4⤵
      PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        5⤵
        
        PID:19024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53213.exe
        5⤵
        
        PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
      4⤵
      PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
      4⤵
      PID:19308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
    3⤵
    PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
      4⤵
      PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
      4⤵
      PID:12524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
      4⤵
      PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
      4⤵
      PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
      4⤵
      PID:19364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
    3⤵
    PID:7184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
    3⤵
    PID:11144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
    3⤵
    PID:14840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
    3⤵
    PID:16896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        6⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe
        8⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        8⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        7⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        7⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        7⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60039.exe
        7⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        6⤵
        
        PID:17840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        7⤵
        
        PID:17440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exe
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        6⤵
        
        PID:16716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
        6⤵
        
        PID:18964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60920.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        5⤵
        
        PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        7⤵
        
        PID:18724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        6⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        5⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44869.exe
        5⤵
        
        PID:17572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18954.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        6⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
        5⤵
        
        PID:16708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43329.exe
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        5⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        5⤵
        
        PID:13452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1993.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
      4⤵
      PID:18148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        7⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32407.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        5⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
      4⤵
      PID:5512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 632
        5⤵
        Program crash
        
        PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
        5⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        5⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        5⤵
        
        PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
      4⤵
      PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
      4⤵
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
      4⤵
      PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
        6⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        5⤵
        
        PID:13480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
      4⤵
      PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5705.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        5⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
      4⤵
      PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
      4⤵
      PID:9044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
    3⤵
    PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
      4⤵
      PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
      4⤵
      PID:7848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
    3⤵
    PID:7888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
    3⤵
    PID:8612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
    3⤵
    PID:13952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
    3⤵
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
    3⤵
    PID:18988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10851.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10851.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 640
      4⤵
      Program crash
      PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        5⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36634.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
      4⤵
      PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18960.exe
        5⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        5⤵
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
      4⤵
      PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30945.exe
      4⤵
      PID:13796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
      4⤵
      PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
      4⤵
      PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
      4⤵
      PID:17196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
      4⤵
      PID:19340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
    3⤵
    PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63073.exe
    3⤵
    PID:10340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
    3⤵
    PID:15476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
    3⤵
    PID:17920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15950.exe
        6⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59768.exe
        5⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44485.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        5⤵
        
        PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65041.exe
      4⤵
      PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        5⤵
        
        PID:18164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
      4⤵
      PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
      4⤵
      PID:17492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50004.exe
    3⤵
    PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8009.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        5⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
      4⤵
      PID:7652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
    3⤵
    PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
      4⤵
      PID:13856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
      4⤵
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
      4⤵
      PID:13536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22721.exe
    3⤵
    PID:9768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exe
    3⤵
    PID:12880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
    3⤵
    PID:10268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
    3⤵
    PID:17892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
    3⤵
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        5⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20869.exe
        5⤵
        
        PID:17552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
      4⤵
      PID:10892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
    3⤵
    PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
      4⤵
      PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
      4⤵
      PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
      4⤵
      PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
    3⤵
    PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
    3⤵
    PID:13040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
    3⤵
    PID:15796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
    3⤵
    PID:16780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
  2⤵
  PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
    3⤵
    PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
      4⤵
      PID:13892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
      4⤵
      PID:7564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
    3⤵
    PID:10692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
    3⤵
    PID:13032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
    3⤵
    PID:16540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
  2⤵
  PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
    3⤵
    PID:13052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
    3⤵
    PID:16984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
    3⤵
    PID:18512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
  2⤵
  PID:1112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
  2⤵
  PID:13660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
  2⤵
  PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 556 -ip 556
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4620 -ip 4620
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4904 -ip 4904
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5536 -ip 5536
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5512 -ip 5512
1⤵
PID:6168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7452 -ip 7452
1⤵
PID:7392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 11076 -ip 11076
1⤵
PID:11288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 15036 -ip 15036
1⤵
PID:19144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 13440 -ip 13440
1⤵
PID:19152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:19104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10851.exe

Filesize
184KB

MD5
4dc01a065c8ffab86134fe92e7feaf3e

SHA1
b7f39760abd5b823ce2ca797c9c1952132fcfb12

SHA256
ee7d1ef6df61b8bb7e374e6f092ea7d672c910009d448a53b60c839aeaa12314

SHA512
1afe1a5a2d04b3073a52a118726c23a21b4a3e8c18b5849b7d0c90dc42adfd36be57b9e60d7303e6ac356c1c654a1428fa57f8f4ddd36294380bcd2399ff07b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe

Filesize
184KB

MD5
054218f6215891551417481efa64e919

SHA1
fe5167d2d5dccc701b839e1170f82bc3a3ece755

SHA256
e3a8cc8dafdafa4b5b4aff5c6f857ac9a2776121ec000b558bf48f5dd83be8d1

SHA512
8bad3e3fe2e263c5e6fe47de032f352765a82dfecb52fa853447f52678b3b954cf9501b6d29381faf8f3a4d8ab580fbaea3d1eb67d8e31040d87c3f113d72aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe

Filesize
184KB

MD5
9c1c4e7f76ba106731b2e788247aa45f

SHA1
a4075249e9aa440e16e1bc6712ef2f81e045cea5

SHA256
342cce838b3df6f7c577f28069ffcb49a4d68f7e079e6b060e6d4aab6cd157df

SHA512
ea8b456b3b6903ba6b601c37b7e0d5776f4f6dfb7ca31d736e22d1af871bddc2ef7b34f980f596567ede8da8b2081b1feb9ba0fd8b37f4fb79f94aa694d514d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe

Filesize
184KB

MD5
923d32270761596f0e5cb1ec3506c037

SHA1
588da937e1b0a97bd72569f2e9998d0219306ab4

SHA256
4d043ce1034d21da7de32aa84f098a6a85405f35383c8c3b60376b5ad28cbae7

SHA512
c71ab91dd435b121e9f4f25edfbf41076f790bfab0ffc135f7f18529e61b91af563a07e72e1c2eac90e780c040182cef334ca7efeeece840a735a73974e5c60c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe

Filesize
184KB

MD5
db4a340127dcad9915c8a2a3d0e07f3d

SHA1
78a8fcfdc8d40b0ebccfaa4cba48d4e43bdc4008

SHA256
1f6b4403dc4cc34fe483a354ce66ca989289f1bba1a8b37d05c8c3624f62d424

SHA512
f6af7c2d62ca975ee56d6faedc7f75684e429afd38d4c9a1b37431aa5b1b456835e23829a37150938b307d3665227adddf04193767d65c1c74df910391f53945

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe

Filesize
184KB

MD5
b7c594e769c55cd699ed69a8ccff9a55

SHA1
395656f35d249800cafb7254b97fc788517dd7e3

SHA256
a84a9648c0f6c3d03360833529fd1397e0bb92010576dd7099e89ad80519bbed

SHA512
990c6fde172e43a0dc0985a53e2e732e396a7caf539949db1235853e4553a1f60b16b21810e34706813fefeca9f768f6da2842cc20b237fee4160edcb500d445

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe

Filesize
184KB

MD5
9a1c66c9c56ff43034ff1e636ccc3caa

SHA1
34a233972542038a259c06a81ce8cf42ff083438

SHA256
5284652f5a87de1277e5f08d41821aa3d481caebad11bf6bf624a357221f70b2

SHA512
a31667482b63a44f065b76fbfcbf3a98bb9e69c73bdaef35f90f2b54bc556b04e4884b59b07b1d55397020595a8cbed54ded0968cb34568c8406d4ed521cad01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe

Filesize
184KB

MD5
417dd65c74c1f570f69b29b0d93b813a

SHA1
1ef33c8b146fd24a085c8a9d9bea494059740744

SHA256
d595428cc433b4af88a43d76a4571f388ca860ae371d105d3935aca973fba27a

SHA512
8bce2529cf26a1a2ec1b83b063a8c4250d501252f231737a248e1b8253c20ae88968fff69a7f9fc4b1775ac438f32e18fa974a92e924bd173eb17031c3b2485e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe

Filesize
184KB

MD5
17d19da47992dc7eeeeebf7324f97143

SHA1
44a4b568c2e8a95bf5f0cebe753aaf33bc15763d

SHA256
638fa22ba3cf94906fff330e776d9d335e1ece20bdba9fd4e71e15a6bd8b787c

SHA512
60ede614cea57fbe77ab808f3f765a592f8e48c09349fc4d17cbdbc833614096f9e5bd07af88f647cb470f26a12c7996bdbb2452cbfd77eca0e4d7427a9e1341

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe

Filesize
184KB

MD5
23c083fe8323b5e0587bb4e99dc609ab

SHA1
ff5355778fce076f06cb2357a96df02b0db92ed2

SHA256
c477a5226049eae2c0168020859d4cdf42923bdfe3cb7383d7a1a1be1e077603

SHA512
6666a7e733154452cd757575387d566f41e6712e58134a98eacbef44df7b6cca51a2613a3084b439a2a4acb0fdd2bf0ba62095aa554a720bb5d799bcda6de43a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe

Filesize
184KB

MD5
ee416942c19891dfb8d12527a4b7c6b8

SHA1
5017b8ef7dedc544d0dc6404c8775ce6f12c56ec

SHA256
be5f5ddb14e4500c7e2aa3a22e9521b09856f2cb567fb925b2b418fd289307c4

SHA512
ba6e07d499777fbd34e94bb16d296e15f0732cdf3fd16f6f76a823d3153cd3a64a29979a71312f37849e2dc73c7cc619f25fa6ebdd40fdb7f52e06cc6462bfb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe

Filesize
184KB

MD5
de57b33ffb34e6707c0b8e0790326e22

SHA1
744d7cf5978d07b8d3f859e636496dfb3e40118f

SHA256
195999d12617868fc788b910f5c3697286475b4d7e70bda069400a654293ed22

SHA512
4804fc4bd959040c48ce27d2ba8530532491a5a2676bbbb284ba50378f9156e4b91e3ac3510e64e6ba593e4593f23fbaf4126344944c473d533cf2a28b533bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe

Filesize
184KB

MD5
a8cbc43630e2c0f4f52eb6eb03cc9f1c

SHA1
f857e1b95d7539444b47a088c11fe2d56cbde373

SHA256
f51761188e4a6efb53f3a03c041ed99611d5e1830351c898baa2d1341dafa6e2

SHA512
78780a6a0dc776a46a9abd19a3291cec73f080b73b5c1e9b79a6561abce5446863c67f6796e486c1b1a947c5d5a2ac757acd892368ff11c5089e2cd885fd3362

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27971.exe

Filesize
184KB

MD5
1a501b63a3098f659098aa6fbbb66146

SHA1
7c840855efb00ed0831a32934bdbab316ae77c38

SHA256
d4873da35a23556f3982b2bc3ce849b769623fe43ac15fd336c8bb83c4f138ae

SHA512
ee022df839465f5f865d14fdc943fb83dbc14ab4a09eaf428f54001d6e16b2e8200fed32cab04fe94c4b4a1561a60d442081c25e710c03ba03aca9da1ee7d879

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe

Filesize
184KB

MD5
9d08b495d2c20011f37a4c63cc73e8ed

SHA1
d6b8753d0d18bcab960da76d2a06fbd69a30d72d

SHA256
f1ecf9dedcf66a79f81e8400c4eb3f36eaaac5c927598a0a6bb75dd48f7e282c

SHA512
441ebf838f74ec934154b0ccc1c8e99c52c80e8c10d0cc952af69a44de396fe7a1e9d87d8d485f2c0dd6001ad86d570394bfc874bb09f219cc6329528f8fd1c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe

Filesize
184KB

MD5
796396b9e5f25f6eec5a9d6a3fab5ed2

SHA1
15238eb49f4aadbeead4f592c93c7f88f856091a

SHA256
c42756199621d84ed7e872107fb9d04222ee2c79deaf4efd7a0099758be8e1d3

SHA512
b4a6932ea5419e96225168c9d89efd0f75949cab8923fc2a3578f28b01c5ff81b8cd632f0601426655d467dd2827d25a236b905d5129b8784eb8cf387d02eaa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe

Filesize
184KB

MD5
47b39894ee6d3849c332a57de715bcd2

SHA1
965a28aecba3d6ae55dc21fe12c23ab8a1570100

SHA256
28c94ee45cc007d653c852ace7adc6fe329f1ed24a813dac5c7ffdfc4c5fca60

SHA512
0267efdd0ee4ad736720cc908b2dedf1a13a7d2fb3bebdf04e7482ba344f952cb2596c1e66c01ef43d38439f6b8231fafe847cb29aed7411f6aac6783a48244c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe

Filesize
184KB

MD5
489c4eac0307b61a82a4a944b8967723

SHA1
8e31a31e28bee54724c55825725d8e66a8d7e0fa

SHA256
8df5b5156971825622ad91705c7b611d2ba51ffb5787a19c83b969ca32780203

SHA512
1eee383c1acba443d91bd4b85cb6840cf78aa951c65fb77b42cbf84d25a244e2ce2e99df7b678b68823df6f9f246f73c8125ddf665208e4d068b94f0e9a64d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe

Filesize
184KB

MD5
47b69e4f14d937026db6132bac0efc0a

SHA1
c6cc955a086a74627851dd6685e67ee8177d6672

SHA256
2a4777fdf473a78979057b47f40aadd230ffe581cd3737f1e1005a8691b61a76

SHA512
f99a3431bcfbcf89be8acc289b8e74b898f50a67ff614e5e3b1a8b02ec5bf8ed19c6362ac2ab1b3ad2de1d8ccf5a59b73f6729ce323c0c35d2a26568fbe1c796

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe

Filesize
184KB

MD5
79c68bdde87bd8576987f3fc20553b9c

SHA1
2414b124d1788992c1500c3a5f9ce6dfc67c01d3

SHA256
935f3bb4cb2d406d2f797a82341afbb014025e48f04c39a088ec2e3b454d1193

SHA512
9f615c28cc86dc56a52128c178534947231b703e4d5fe15ff91138411558dc3b0e369198c8f0cd30409a718a0c9340970d808f37c81760e58d638c932787fda8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe

Filesize
184KB

MD5
c16e47cdb9d63944a075b71ec0962338

SHA1
45ad56c307633ef17f89881cc01a19e1f2a15a99

SHA256
2f3ec7868a32507ffba3773ee29d30ef8aa45c8b2f910dfcfc29c16381cc7a4a

SHA512
96517da30bb06dae343e3aa62e9d90f29ad5a7d30b53dd8954edec51f67335619c1058f5913d919e52f9bd473e92dcc33fac710656d711ad647c00672931bafd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe

Filesize
184KB

MD5
89199d3661ee876ecc8f2b9285ead9d7

SHA1
d2d5227fb5ce9414035836626bae1dcd9a94d4b4

SHA256
ab7f3896b32af26f2697edb706abe0c6d49398ac5a48c1ed005a65fb17c9ecd6

SHA512
a8dc8b17298834052f261610d3cb50c7ff81b0cfbfba3712b6bb35c91460e7c8e9db8f2684413d84ef8ce4dd3042c980911ee6bde4cef083d958bdbf767a7acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe

Filesize
184KB

MD5
56b182bccb138cc490901285a467e5a2

SHA1
f0c668a8346ec4f562916b6416f05ceb70b0b876

SHA256
95af9f5fd1e8dc698e27a509bdbc412c6013ccb8a0c2f4bd23e6f5252d3bd764

SHA512
eb6cfbc979a5b853976a77c9af83e80e921855e909abccf62fa09014cddd022cbe129264e95530680e490d1b76b40fb07ca4dc702f7e3157cbe4ee28b56fcdee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe

Filesize
184KB

MD5
5202ecf130527bf96b621b96a83e9a19

SHA1
7635a3410ffec680d444a0b3126033533a0a107f

SHA256
f0e60d202982a26d88ceadaaef0de061a08fa6ecc552cd6b1fe01585cd3ea519

SHA512
ab4eec6e0c0388304aadfd0585078a5465ef7b41b17bbee55bbcb1de988b6b8596b160cffd73cd03c6408ce688caf09885f4011e5c4d39a68bedf04311d17499

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe

Filesize
184KB

MD5
1ca2fdab229eac6effe5ead329a066bc

SHA1
9b5af3d8f98b13720917d7b82b33ed9da4886f08

SHA256
6e300893a65281eed304579a1fa385c1ed1c8da031ce2f509482bd013d3aa88e

SHA512
fe2810a9a27d3c091d74a729d082b732665366f5ee2e655d5a89b5814da317e38e1ba6923a821e5901721652a2844f86511ad81c773fdd33f404e8a4b6ba487f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe

Filesize
184KB

MD5
68f4edb4e84318efefb22939dfbd529f

SHA1
c8092aa9f69cfaba11d1137750b16be691cf5af0

SHA256
ac2569427394bd50c62e7753c57af752fcf1a2001adee7cb2238c148bbc31bae

SHA512
c50404cd9f5afcf53469bc6054a4c948fcc4dc08e8c87652d5d83368d8303dcadd2d0fa523104c5598288d104207f1f13f47810a4cc3197c8f3b6ccbaaa0a5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58029.exe

Filesize
184KB

MD5
e7d287587c47549e629315a9b76b28c7

SHA1
261aa71adb553afe2d2b02582f0afeb6d69c767b

SHA256
6474db59434877a565a16e260ada7d45cee99da403eed669d833253da6ae95aa

SHA512
7ce58e0cd2870ce01d849857c8783e54f60224a6b2c4b9e293e7c37397751f5f06937e694ebe5040ad38889afcc60f035875f4c8bb4d4372a737bf500b9198c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58765.exe

Filesize
184KB

MD5
1d0fa21aa5786186121eaf714aad1531

SHA1
593d47a375911fb2539e2c734b1f7ab8d45769af

SHA256
14e1a1f0fec8f7dd434acf37efb0f35f5b8b648bd2c56d81f4095681bc1ca6d8

SHA512
2a1d2f2182a62181b3ff12107e70e5c43a2ef7c3589f65cfda06a7086d01291ad9a855358a3df33095e0e5989fab48d2e0d18c6ff7baa4f6dace9de381a405ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe

Filesize
184KB

MD5
add76d0c88d30f790bd790d9ee96aaa2

SHA1
0180826c2586b90f0ac104cc185f22aadbbb0673

SHA256
a0fb3f408e09f3ef4309282764ef66945aa8b08d2b6b4cf99ef0c5f39905ea70

SHA512
0c1e29cb2c6f69b7b11fa55b02772dfd324c7c70a730b899ee91e8559d7ec095d2baefcb382a6d18e9dcee30b94f9a1bc2e7360b32e48eb0f5ba58205d7362b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe

Filesize
184KB

MD5
539b7804b7e2a4bb7b5997a767d54c25

SHA1
85a28282f9ed3885a2f5553d17afdb91a9661121

SHA256
263bf702a75aa825544bf45907218ebc6352825c50d8e59fe006db3b73ab314c

SHA512
74037a14dd5da89e13123527a8e78363c354020bc5d6991d601528a3c6500a52b37292c1f65a1f0c580d95d4242f1252f8f8ea15b531a63f1dfe67bcb38fbac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe

Filesize
184KB

MD5
44c830bd57bec76f391b5512aeeb174e

SHA1
c443a7ead2fe5655d9d7c58c57ca2d6179ed40aa

SHA256
e3ee8f93f0a69a204ea716f5604f4ab87c46a2442a87e77c3a8ed888a5699171

SHA512
041037cdd746c96311667ae347df4b08cd63dc30ff4c817cb01775887f5d4873ae3f7d42c09e2d67e35fa58a0bfdc1245152de075f0b64f18b9ddb8bffed2230

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9372.exe

Filesize
184KB

MD5
bf67907c8110135311c58d6513d8961f

SHA1
01f1d4618d95de56effc223ff525482ecaf1df5d

SHA256
994d1b1217d925451d4684bfb6a7501195cc348e7ee57e87d5f63ef4019d8a22

SHA512
82722af1d030745ff35b2156fa9b7437de70398971b5cf8ade69aa7f4aa5522b97b1ed15e6ef98f02c679ac4cd52e6ae5af45be63ca72f113d9ac81cd5530164

Download Submit
memory/9060-3141-0x00007FFA085E0000-0x00007FFA08639000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads