0bfcf3dfd3151cd560f93491a1b30266f3224e9fc4020452fae633d7c4dee6ce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe
Size

184KB
MD5

daa530a6fceef217d039ba0e887ffe70
SHA1

70bf074ab4323e53ead7e3db44231d30a6ef6ded
SHA256

0bfcf3dfd3151cd560f93491a1b30266f3224e9fc4020452fae633d7c4dee6ce
SHA512

4eea22957d095cbc7353743969a270d933cfc4699edc77adc335349bae55e9ff87ae740e703b51862e0b353ad10bcc0b2336eedb27299a80aabd3e25935c6cbf
SSDEEP

3072:jn8w+ConDHWS2dy1tZOk8hwMKlvnqnviut:jnXoZCy1n8aMKlPqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2804	Unicorn-48282.exe
228	Unicorn-17530.exe
1564	Unicorn-22360.exe
5028	Unicorn-15557.exe
1068	Unicorn-65313.exe
1712	Unicorn-44338.exe
3324	Unicorn-25955.exe
2148	Unicorn-55926.exe
2104	Unicorn-52397.exe
3480	Unicorn-47758.exe
2836	Unicorn-43674.exe
804	Unicorn-37544.exe
5108	Unicorn-59553.exe
4132	Unicorn-39952.exe
4720	Unicorn-46341.exe
2140	Unicorn-62122.exe
2164	Unicorn-54509.exe
2552	Unicorn-37426.exe
1692	Unicorn-43548.exe
3664	Unicorn-26518.exe
3868	Unicorn-35240.exe
4392	Unicorn-58998.exe
3816	Unicorn-63082.exe
4364	Unicorn-58998.exe
2188	Unicorn-25563.exe
2400	Unicorn-34494.exe
4812	Unicorn-14628.exe
3656	Unicorn-34229.exe
4084	Unicorn-32447.exe
3940	Unicorn-28415.exe
4304	Unicorn-38621.exe
1484	Unicorn-48835.exe
1216	Unicorn-41413.exe
2648	Unicorn-20247.exe
3020	Unicorn-5948.exe
3680	Unicorn-1170.exe
1292	Unicorn-13422.exe
3436	Unicorn-11376.exe
4544	Unicorn-59094.exe
1920	Unicorn-53806.exe
4756	Unicorn-8762.exe
4500	Unicorn-1149.exe
4916	Unicorn-1938.exe
1128	Unicorn-18275.exe
5092	Unicorn-10469.exe
1592	Unicorn-59862.exe
4724	Unicorn-46671.exe
1568	Unicorn-62437.exe
3068	Unicorn-22167.exe
4624	Unicorn-13998.exe
2960	Unicorn-18445.exe
1532	Unicorn-42130.exe
1112	Unicorn-48517.exe
4524	Unicorn-26613.exe
5068	Unicorn-13998.exe
2920	Unicorn-42395.exe
4932	Unicorn-29181.exe
4060	Unicorn-12336.exe
3056	Unicorn-8113.exe
4928	Unicorn-27979.exe
5020	Unicorn-36509.exe
368	Unicorn-48954.exe
968	Unicorn-43931.exe
220	Unicorn-43931.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2832	3020	WerFault.exe	121
7768	6216	WerFault.exe	309
6756	7020	WerFault.exe	307
4328	10608	Process not Found	1282
5916	6356	Process not Found	1025

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
18180	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17272	dwm.exe
Token: SeChangeNotifyPrivilege	17272	dwm.exe
Token: 33	17272	dwm.exe
Token: SeIncBasePriorityPrivilege	17272	dwm.exe
Token: SeCreateGlobalPrivilege	13872	Process not Found
Token: SeChangeNotifyPrivilege	13872	Process not Found
Token: 33	13872	Process not Found
Token: SeIncBasePriorityPrivilege	13872	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe
2804	Unicorn-48282.exe
228	Unicorn-17530.exe
1564	Unicorn-22360.exe
5028	Unicorn-15557.exe
1068	Unicorn-65313.exe
1712	Unicorn-44338.exe
3324	Unicorn-25955.exe
2148	Unicorn-55926.exe
2104	Unicorn-52397.exe
3480	Unicorn-47758.exe
804	Unicorn-37544.exe
2836	Unicorn-43674.exe
5108	Unicorn-59553.exe
4132	Unicorn-39952.exe
4720	Unicorn-46341.exe
2140	Unicorn-62122.exe
2164	Unicorn-54509.exe
2552	Unicorn-37426.exe
1692	Unicorn-43548.exe
3664	Unicorn-26518.exe
4392	Unicorn-58998.exe
3816	Unicorn-63082.exe
3656	Unicorn-34229.exe
4364	Unicorn-58998.exe
4084	Unicorn-32447.exe
2188	Unicorn-25563.exe
4812	Unicorn-14628.exe
2400	Unicorn-34494.exe
3940	Unicorn-28415.exe
4304	Unicorn-38621.exe
1484	Unicorn-48835.exe
1216	Unicorn-41413.exe
2648	Unicorn-20247.exe
3020	Unicorn-5948.exe
3436	Unicorn-11376.exe
1292	Unicorn-13422.exe
4544	Unicorn-59094.exe
1920	Unicorn-53806.exe
4500	Unicorn-1149.exe
4756	Unicorn-8762.exe
4916	Unicorn-1938.exe
5092	Unicorn-10469.exe
1128	Unicorn-18275.exe
1592	Unicorn-59862.exe
4724	Unicorn-46671.exe
1568	Unicorn-62437.exe
3068	Unicorn-22167.exe
1532	Unicorn-42130.exe
4624	Unicorn-13998.exe
2960	Unicorn-18445.exe
5068	Unicorn-13998.exe
1112	Unicorn-48517.exe
4524	Unicorn-26613.exe
4932	Unicorn-29181.exe
2920	Unicorn-42395.exe
4060	Unicorn-12336.exe
3056	Unicorn-8113.exe
4928	Unicorn-27979.exe
5020	Unicorn-36509.exe
368	Unicorn-48954.exe
968	Unicorn-43931.exe
220	Unicorn-43931.exe
936	Unicorn-6909.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2804	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	87
PID 2180 wrote to memory of 2804	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	87
PID 2180 wrote to memory of 2804	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	87
PID 2804 wrote to memory of 228	2804	Unicorn-48282.exe	88
PID 2804 wrote to memory of 228	2804	Unicorn-48282.exe	88
PID 2804 wrote to memory of 228	2804	Unicorn-48282.exe	88
PID 2180 wrote to memory of 1564	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	89
PID 2180 wrote to memory of 1564	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	89
PID 2180 wrote to memory of 1564	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	89
PID 228 wrote to memory of 5028	228	Unicorn-17530.exe	90
PID 228 wrote to memory of 5028	228	Unicorn-17530.exe	90
PID 228 wrote to memory of 5028	228	Unicorn-17530.exe	90
PID 2804 wrote to memory of 1068	2804	Unicorn-48282.exe	91
PID 2804 wrote to memory of 1068	2804	Unicorn-48282.exe	91
PID 2804 wrote to memory of 1068	2804	Unicorn-48282.exe	91
PID 1564 wrote to memory of 1712	1564	Unicorn-22360.exe	92
PID 1564 wrote to memory of 1712	1564	Unicorn-22360.exe	92
PID 1564 wrote to memory of 1712	1564	Unicorn-22360.exe	92
PID 2180 wrote to memory of 3324	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	93
PID 2180 wrote to memory of 3324	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	93
PID 2180 wrote to memory of 3324	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	93
PID 5028 wrote to memory of 2148	5028	Unicorn-15557.exe	94
PID 5028 wrote to memory of 2148	5028	Unicorn-15557.exe	94
PID 5028 wrote to memory of 2148	5028	Unicorn-15557.exe	94
PID 228 wrote to memory of 2104	228	Unicorn-17530.exe	95
PID 228 wrote to memory of 2104	228	Unicorn-17530.exe	95
PID 228 wrote to memory of 2104	228	Unicorn-17530.exe	95
PID 1068 wrote to memory of 3480	1068	Unicorn-65313.exe	96
PID 1068 wrote to memory of 3480	1068	Unicorn-65313.exe	96
PID 1068 wrote to memory of 3480	1068	Unicorn-65313.exe	96
PID 1712 wrote to memory of 2836	1712	Unicorn-44338.exe	97
PID 1712 wrote to memory of 2836	1712	Unicorn-44338.exe	97
PID 1712 wrote to memory of 2836	1712	Unicorn-44338.exe	97
PID 2804 wrote to memory of 804	2804	Unicorn-48282.exe	98
PID 2804 wrote to memory of 804	2804	Unicorn-48282.exe	98
PID 2804 wrote to memory of 804	2804	Unicorn-48282.exe	98
PID 2180 wrote to memory of 5108	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	100
PID 2180 wrote to memory of 5108	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	100
PID 2180 wrote to memory of 5108	2180	daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe	100
PID 1564 wrote to memory of 4132	1564	Unicorn-22360.exe	99
PID 1564 wrote to memory of 4132	1564	Unicorn-22360.exe	99
PID 1564 wrote to memory of 4132	1564	Unicorn-22360.exe	99
PID 3324 wrote to memory of 4720	3324	Unicorn-25955.exe	101
PID 3324 wrote to memory of 4720	3324	Unicorn-25955.exe	101
PID 3324 wrote to memory of 4720	3324	Unicorn-25955.exe	101
PID 2148 wrote to memory of 2140	2148	Unicorn-55926.exe	102
PID 2148 wrote to memory of 2140	2148	Unicorn-55926.exe	102
PID 2148 wrote to memory of 2140	2148	Unicorn-55926.exe	102
PID 5028 wrote to memory of 2164	5028	Unicorn-15557.exe	103
PID 5028 wrote to memory of 2164	5028	Unicorn-15557.exe	103
PID 5028 wrote to memory of 2164	5028	Unicorn-15557.exe	103
PID 2104 wrote to memory of 2552	2104	Unicorn-52397.exe	104
PID 2104 wrote to memory of 2552	2104	Unicorn-52397.exe	104
PID 2104 wrote to memory of 2552	2104	Unicorn-52397.exe	104
PID 228 wrote to memory of 1692	228	Unicorn-17530.exe	105
PID 228 wrote to memory of 1692	228	Unicorn-17530.exe	105
PID 228 wrote to memory of 1692	228	Unicorn-17530.exe	105
PID 3480 wrote to memory of 3664	3480	Unicorn-47758.exe	106
PID 3480 wrote to memory of 3664	3480	Unicorn-47758.exe	106
PID 3480 wrote to memory of 3664	3480	Unicorn-47758.exe	106
PID 1068 wrote to memory of 3868	1068	Unicorn-65313.exe	107
PID 1068 wrote to memory of 3868	1068	Unicorn-65313.exe	107
PID 1068 wrote to memory of 3868	1068	Unicorn-65313.exe	107
PID 2836 wrote to memory of 3816	2836	Unicorn-43674.exe	110

C:\Users\Admin\AppData\Local\Temp\daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\daa530a6fceef217d039ba0e887ffe70_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15557.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        9⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        10⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        10⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        10⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        10⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        10⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
        9⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        9⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        9⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        9⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        9⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        8⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        9⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        10⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        10⤵
        
        PID:17888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        10⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        9⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        9⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        9⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        9⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
        8⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        9⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55566.exe
        9⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
        9⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        9⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
        8⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        8⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        8⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21000.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13822.exe
        8⤵
        
        PID:18344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9552.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32161.exe
        8⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        8⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        7⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17528.exe
        7⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        8⤵
        
        PID:660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        8⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        8⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33977.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        7⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47161.exe
        7⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        8⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51062.exe
        7⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        7⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
        7⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exe
        9⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        9⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        9⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exe
        9⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        8⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21521.exe
        8⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exe
        7⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63989.exe
        7⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        6⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35669.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
        8⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        8⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        7⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        7⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        7⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
        7⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7449.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
        6⤵
        
        PID:17968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 720
        6⤵
        Program crash
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        7⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43749.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        6⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        5⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        5⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        5⤵
        
        PID:16708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        6⤵
        Executes dropped EXE
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6313.exe
        8⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        8⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
        7⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
        7⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        7⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35285.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42965.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        7⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        7⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
        6⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        6⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
        8⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        7⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        7⤵
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8128.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13181.exe
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
        5⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        7⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        6⤵
        
        PID:17628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
        6⤵
        
        PID:18272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        5⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        5⤵
        
        PID:17984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        5⤵
        
        PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        7⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
        6⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        6⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        5⤵
        
        PID:7020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 464
        6⤵
        Program crash
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        5⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        5⤵
        
        PID:8124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
        7⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        6⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        7⤵
        
        PID:17584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23159.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34393.exe
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55758.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        5⤵
        
        PID:17772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        6⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        5⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        5⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        5⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        5⤵
        
        PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
      4⤵
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4328.exe
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      4⤵
      PID:15300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
      4⤵
      PID:17996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        9⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        9⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45206.exe
        9⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        8⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60933.exe
        7⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        6⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14974.exe
        8⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        8⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        8⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        8⤵
        
        PID:18408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        7⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        7⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        7⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        6⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11834.exe
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18041.exe
        8⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        8⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        7⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
        7⤵
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
        7⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        7⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53097.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35400.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        5⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46810.exe
        7⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        6⤵
        
        PID:18220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55395.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        6⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        5⤵
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        5⤵
        
        PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
      4⤵
      Executes dropped EXE
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30211.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        7⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30161.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63009.exe
        6⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        6⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        6⤵
        
        PID:18272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13364.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        5⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        5⤵
        
        PID:17940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      4⤵
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        5⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
        5⤵
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
      4⤵
      PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
      4⤵
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
      4⤵
      PID:15264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
      4⤵
      PID:18040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
      4⤵
      PID:7524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52675.exe
        6⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        8⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42965.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        8⤵
        
        PID:16984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        7⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        7⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3241.exe
        7⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11128.exe
        7⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        6⤵
        
        PID:18032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
        6⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
        5⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        7⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51854.exe
        7⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61762.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        5⤵
        
        PID:18304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        7⤵
        
        PID:17676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
        7⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        6⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        6⤵
        
        PID:17688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        6⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29208.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        5⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        5⤵
        
        PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
      4⤵
      PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        5⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
        6⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17501.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        5⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        5⤵
        
        PID:17696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
      4⤵
      PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32987.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        5⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        5⤵
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39153.exe
      4⤵
      PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
      4⤵
      PID:11972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
      4⤵
      PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
      4⤵
      PID:18260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        5⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        7⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40211.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        6⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51414.exe
      4⤵
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63838.exe
        6⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        6⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58223.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        5⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53706.exe
        5⤵
        
        PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
      4⤵
      PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
      4⤵
      PID:12800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
      4⤵
      PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
      4⤵
      PID:18008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11104.exe
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
      4⤵
      PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
      4⤵
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
    3⤵
    PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
      4⤵
      PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35373.exe
      4⤵
      PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
      4⤵
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
      4⤵
      PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      4⤵
      PID:17656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
    3⤵
    PID:6216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 408
      4⤵
      Program crash
      PID:7768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
    3⤵
    PID:9600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
    3⤵
    PID:13148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
    3⤵
    PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
    3⤵
    PID:17748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        8⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
        9⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        9⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12908.exe
        9⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
        9⤵
        
        PID:18412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        9⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        8⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        8⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        8⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        8⤵
        
        PID:17748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
        7⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        7⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        6⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        7⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
        6⤵
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        6⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        8⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        8⤵
        
        PID:17832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        7⤵
        
        PID:18224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        7⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50210.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
        7⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        6⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13181.exe
        6⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        7⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14532.exe
        6⤵
        
        PID:18400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53090.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19929.exe
        5⤵
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        5⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        5⤵
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61394.exe
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19220.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7322.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18965.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27502.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        5⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        5⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1964.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        5⤵
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53490.exe
        5⤵
        
        PID:15536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2182.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43667.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        5⤵
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        5⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5969.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
      4⤵
      PID:16240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        5⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52530.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26060.exe
        7⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        7⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63961.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        6⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        6⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        5⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        5⤵
        
        PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        5⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        7⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        7⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35710.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65269.exe
        6⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
        6⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17175.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        6⤵
        
        PID:13920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        5⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        5⤵
        
        PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        5⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        5⤵
        
        PID:16100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
      4⤵
      PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5594.exe
      4⤵
      PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        5⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61813.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        6⤵
        
        PID:17656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        5⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46221.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14670.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        5⤵
        
        PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32161.exe
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        5⤵
        
        PID:17456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
      4⤵
      PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
      4⤵
      PID:15492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
      4⤵
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
        6⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        6⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19857.exe
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        5⤵
        
        PID:18020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        5⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe
        5⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        5⤵
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
      4⤵
      PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
      4⤵
      PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
    3⤵
    PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
      4⤵
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37874.exe
        5⤵
        
        PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
      4⤵
      PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe
      4⤵
      PID:12760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe
      4⤵
      PID:16192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
    3⤵
    PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
    3⤵
    PID:9708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
    3⤵
    PID:13216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
    3⤵
    PID:15832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56694.exe
    3⤵
    PID:5744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25955.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25955.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18965.exe
        7⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        6⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21636.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
        6⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        6⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        5⤵
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        6⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        5⤵
        
        PID:13256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        5⤵
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      4⤵
      PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18836.exe
      4⤵
      PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9317.exe
      4⤵
      PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4006.exe
      4⤵
      PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
      4⤵
      PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        6⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        7⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        5⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe
        5⤵
        
        PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        5⤵
        
        PID:16256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
      4⤵
      PID:10900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
      4⤵
      PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
      4⤵
      PID:16948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        5⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
      4⤵
      PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
    3⤵
    PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
      4⤵
      PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
      4⤵
      PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4320.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
    3⤵
    PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
    3⤵
    PID:10152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
    3⤵
    PID:13276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
    3⤵
    PID:3512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        5⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32161.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        7⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        7⤵
        
        PID:17488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        6⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        6⤵
        
        PID:18140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        6⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        5⤵
        
        PID:18320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        5⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
        5⤵
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
      4⤵
      PID:11560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
      4⤵
      PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      4⤵
      PID:17816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
      4⤵
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        5⤵
        
        PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exe
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
      4⤵
      PID:17612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
      4⤵
      PID:948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
    3⤵
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
      4⤵
      PID:10312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
      4⤵
      PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
      4⤵
      PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
      4⤵
      PID:17840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
    3⤵
    PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
    3⤵
    PID:9980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1533.exe
    3⤵
    PID:14068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
    3⤵
    PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
    3⤵
    PID:17704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
      4⤵
      PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
      4⤵
      PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
      4⤵
      PID:15568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
    3⤵
    PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
      4⤵
      PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
      4⤵
      PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
    3⤵
    PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
      4⤵
      PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
      4⤵
      PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
      4⤵
      PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
    3⤵
    PID:9988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
    3⤵
    PID:13628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
    3⤵
    PID:16792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
    3⤵
    PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19577.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
      4⤵
      PID:16120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52818.exe
      4⤵
      PID:460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
    3⤵
    PID:8148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
    3⤵
    PID:10532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
    3⤵
    PID:14956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
    3⤵
    PID:17644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
  2⤵
  PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
    3⤵
    PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      4⤵
      PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
      4⤵
      PID:18256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
    3⤵
    PID:8544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36489.exe
    3⤵
    PID:11664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16121.exe
    3⤵
    PID:14428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
    3⤵
    PID:17928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
    3⤵
    PID:6512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
  2⤵
  PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
    3⤵
    PID:14404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17437.exe
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
    3⤵
    PID:7996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
  2⤵
  PID:9280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43405.exe
  2⤵
  PID:12464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
  2⤵
  PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 3020
1⤵
PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6216 -ip 6216
1⤵
PID:7576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 7020 -ip 7020
1⤵
PID:7008

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:18180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe

Filesize
184KB

MD5
5fa4d4a14fec5ace6c57bcfaf476cbd2

SHA1
29c705b0796312b8b1a9a43daa65607da19ad9e0

SHA256
c1053b06572254236ba90999f42309b43560a8fcc6b530fff7c7f24dd5af6dbb

SHA512
cbfd0d1a90292c261967ebbd7f787a106632e23a01fd3a7d14f68e7bf4dbf3bcdd9c0987c0f8995fc53272a68156e86f5c07b72cf8d22e452ddee6d1b0359c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15557.exe

Filesize
184KB

MD5
d9ae0e2519f2d7c42eedcb5cd736938d

SHA1
3ac154c3bf3840900650a60ec323340a1c2d65a7

SHA256
621b6af1c55f3e39b8161b9ad39392f9cf7190ca144b77d3ed1d3619c539c7b4

SHA512
df4237c9a2916fa6e35e22b0cc082f2833ba99fd9794d3bd30d01ba20aaf8f654c26de89eff533c0daf8ef66026affe6314bf27ab57e8cd0adf7e6f025bc506a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe

Filesize
184KB

MD5
20a3f39d42305a03fa08d77115f0f05f

SHA1
c3668d95313e037ffb75e7641f992b47b5bc61e2

SHA256
110e9323227844979addd2af48f1dba1318d37789ecbd050dac9d03b8ef88c24

SHA512
0217784f5d8d9ccbc649caeb2d612642c3c0534a7de161ac6ee1274423f73ea19297cb40a0ae964265affdacea20dcad9931d70323ac9c02196da6bf68001200

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19857.exe

Filesize
184KB

MD5
912804d65c5800e52282f8489b9e4fa7

SHA1
084dde60517f927208e75c76adb630083ae105eb

SHA256
e2d5ba778225cc390be47d62fdd40bbcc47bd430c6621df56d873e76cffcacbd

SHA512
55b59cb2eaffa8ac7d14de775ea648e3c597870cbc12125f8bab2f09005bf0cf45f20161790d2a97b102ab6ea25bfc793e60b2bc52edc3688869a8184d1c4a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe

Filesize
184KB

MD5
48aae63bf4c264ed6eb9a70fe378e350

SHA1
9b5c171180f9a0dc8d28bc4c3398fd4c16653744

SHA256
4e956cd4028e0a00d6ed0ee33e5d3656bd537a32c04471ba4da07e5d8cec191d

SHA512
bb3cb5cf6978f188d0619322b59d115f01353e0e76cda83e9662db78ae29a2a496a3a299e9e22a94279db790f47948ef5133be80e72a8d441c8391bb3d11155f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe

Filesize
184KB

MD5
f84262d3c003d8a74fce0d3000db190e

SHA1
3d7b682d85c99cbbdca6f687e62091be4f690743

SHA256
5d24cb62b53b263abcdb75e7576c4b1e3bff274ef9d13dc285c25fa1c50d1e41

SHA512
a0dbf86469437c081b79722252d82abd0fffa71ba1b2e9573a3ebe43eb5f92d7b2a3773d5feb1185757902c494a1ba3996e9cca10144be202d3a360f148d2e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25955.exe

Filesize
184KB

MD5
e1bcf39d57d418dc051b5d3d2cd0670f

SHA1
6d1c976bf0d1e2acfd07b349464d7be9217416b5

SHA256
a79580de8841f89520d5d65e7d080a94b3407b2108e0042dbaec5fbdcbbc50e0

SHA512
44674bf7ab752a790d2c09eb137eb777c9bbaab17d8c72a1062f9df70f819d087ec1913007bf497aa45a64748427a423acc6d3bec10fa8b83ee8b9157a1c2f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe

Filesize
184KB

MD5
45774424df8d6102141939a865d3dafe

SHA1
7e43e0e06138ae4ff9a701114a8291a908dfee31

SHA256
31009c9c49c5e64d61ced41e356f1084f18213f005dfeed17b88acb3f1c5f661

SHA512
6e507370ac42bfaa586d9e78f027c83cbcddae3959a4f4e3e019c325ca3c6153910872c1a97f61e3649ad7a0e8e5d6b964cb05b13704f6f45b38cb0723eacb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe

Filesize
184KB

MD5
d88b016d7e40fd4c97fbfa6cb4f5f898

SHA1
20f51bee81e044ed0a4b038394eec8f91d1a2e20

SHA256
affaf7864661d967604f88a7b08b015bfc07317ec793a8840e2a45687d13db66

SHA512
50ed997a7ed1fb014be7598aafd63338c4655acb3348184225e1caff0e67015cc41d6b793e99e19c491e565dd94705a94dbc5a37d4aaf9e2bb031e394f960efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe

Filesize
184KB

MD5
ad7a0e69fc79c84a15f2092148fece84

SHA1
a0567d66f894c1914cbf72be5f2958477d7fc305

SHA256
d61dfac16c65fe115cd846a4cf75b5505360ea68301f213e7acc12324ab4bef0

SHA512
3e8fe0ff04a36b19768826c3467e6570f34f2c27b4dfb8dabcb5262ab35935f3ead2ab2a77e4cc15888f6e2efe75dd0a8a120b8c0f92ead14917a971564ae2e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe

Filesize
184KB

MD5
df57d88ebc67bcac2acdf68bb2b16871

SHA1
e8315bad8c7e44c7c30030885b14a04641402edd

SHA256
858cb1c06a9e26972ffaa0d141e50c4793cb89329584924b61a02f450ecc0d92

SHA512
b7dd34765e5dbb48d7e7ab4539410b7b76dcd16f9d3f273c63e2438473e0b721e7662f0133dabfd00aefbac6c41c0cbe7b674a70e8a4dbcc79d5839a29356a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33977.exe

Filesize
184KB

MD5
dc65d3067a882739e40f4afddc35070b

SHA1
2865816650675a4369922e218ce1293df374faac

SHA256
e729ff139bccd11631e15df4383cf836ce9bbb385400454ea577aaef46fd3a2d

SHA512
fb949abd096732375b7abe145accd243c4c5c016625a8fee1de16e9abdbf475077b3cc54cef63e58fb314eefcc331d4589680e7aa123fd82431b8f082f734ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe

Filesize
184KB

MD5
a712ae8e0df02da70a3a0b0a10e3fb25

SHA1
c2ccec8fcdb95b486adad79a3fec87c228936b43

SHA256
d9f2303cad79136ae9ede5e8fa5683b0da1538e1659ce1cb7b291e5f74fa861b

SHA512
96ef6a53d0ff04fd1071f90f96c71d836f35d6e5761a456adae995b57e535770d74c85f1021f7595a7fa5932135cf5ae4d648199b0b881b37c4d394399740d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe

Filesize
184KB

MD5
959f223a49034039fb533f9cf99f4cb8

SHA1
ad803efff738671a94816d7679974fa62c181a37

SHA256
29c3f6ba468f2bb53c6c7945e1d5489056602484a2ae5509b06a4bbb744015de

SHA512
9056e88be38f2f0ffdf734df32e3b2943fb8244e9e034eeb32c9a3843cd5fa99068e852b13220625e6365b6831a672a5b4c52de01b0215d9269c3c7f100f61a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe

Filesize
184KB

MD5
28044738073e90fbfb7d4030ead24a26

SHA1
449f4c50c227be9acb947d93e2bc95c13aa68f24

SHA256
43f471e3383c50717e873d2349142910938a061db6b6c6316f5b195129acf75e

SHA512
76a11d6d1a79a0e1e5f11e0f483ef2ca915c7361380f075707115d20e5378fb199d9e2d3deb523bf64b92bc3fc94c22de8db2b0fc763cd1b1e825e11fdb980c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37426.exe

Filesize
184KB

MD5
52481d13767fe1117020a85be3cb332f

SHA1
622f47fb5d3256baea37647f9177ec2302cd5e9f

SHA256
711f1dac68f41ad422a86b27065988161b80847b5d3d4b16d45ba763c925adf2

SHA512
ec50a7ee0b9ad404c0e951897d1da059cc84110d63d3c7afd308a147bac731e2d983fa5c86caefa97bb431071ad734439e72ac899c739ebe9671f1f56f82db9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe

Filesize
184KB

MD5
cbd2616b0f5810f04b187f9a2320d92d

SHA1
040bba80c95a18cb5767cdec5429a9c1b54c4d7f

SHA256
a02e8c40ba4d84442aed315d6132d031f59ee98d65d579d29febcf74affb2b06

SHA512
ea3c7259006d7dda8d1c08dabaa352b4f55dc1296fa5e439858f7edc7764748d0088911094488a5c888b4278db50a03115ba30dce8f3a4ac9835940f32e5d9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe

Filesize
184KB

MD5
f038f4659eb2de3df469228ddd3c9e24

SHA1
4b5f38bce45f461559988c839c02435303d2528e

SHA256
ad20b52fea077029ffe4df463e4332776e4714befc559176e50651f84d10c89d

SHA512
8404bed60f0aa3b47507e1bf021cb2c5209854e885298923371e74a0438c901664488aa9bc062192e6d86092086b8e3a348580fd1e4d7f53429e4c25cceea61d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe

Filesize
184KB

MD5
138099e7590f98f7f7197c56c0ddaffc

SHA1
7e261d77a58a8778729f2c386994d17fe2fea78e

SHA256
77aaeb43ed220b19b12d63db5bbdcae10920f46803a0f573379440429fefbad1

SHA512
b0b0115c8f599daee6995c32c48bddb52e157897cba1ff01b767a07a851ab1252a5190befa73af904ea7a2a966e998352b969a1907425c00efac4441bac57b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe

Filesize
184KB

MD5
77d3d351adaea56bcd2d5fd0487b1531

SHA1
39d69168eb8680ef51d8fcea281b1097bf71c220

SHA256
b47344a160005f2e5b1ba082e913d5de3a33d79da0d4b7f775625780964d9f6e

SHA512
6892d81c3ab64fe82ce81f4f0e5717cdb05a8c97a48235430ce1b5a35f37a3c8316a0e51fdbc2b6250086cafa6ed199ed20c16a41fac710eb91f8aac590f3936

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe

Filesize
184KB

MD5
996cb41e3f3b444212fc644f2de7a234

SHA1
941ccf20f00a93876561ea4efc3435291b8dcbad

SHA256
e124d77283c22f2e7cab1c10b1e8900299d72a2ec394e702e28c36479ebbb25e

SHA512
331fb6f8f22d07f0b39b0559fc861dbfadd1e32cd2fbd2cdce8d92e7b8d6084721f4dbf5cc48591612b6c879b34359cd94bb28338dba62d3f438147c68711744

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe

Filesize
184KB

MD5
b5f5b6da3c5c4eb3d64085c9b596939a

SHA1
8a62b952cf25ce0f1f3824e8fca2659a72544b6a

SHA256
cd9f594dc65422a236d97b37bb757f1d76ae13f1c13812eb3af1dffcc2aac84d

SHA512
9ce811c553d5c13d9761c129b46c59f92660845f5056a38114882158c7422b6dc56d6c707cbc401bccd6505b70419213e9d0399b6621dd4b057742e7af7dfd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe

Filesize
184KB

MD5
2f408431b54b8ae85af1cc721078142b

SHA1
0325954632cb3ff7cc12ae7f452eab2f1966d8fe

SHA256
51573797f7bee653f61780a9040c462687afc902c30c60bdca858127dc26b36b

SHA512
006bc7a259dbcf1d88068ccd9be6e23b16934a2c5eacc39af35b68ee9917e04c5647819656355eeea8ce133156cfa27e9fff32bfb2e5ca3d5de11e38195a9fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe

Filesize
184KB

MD5
b1f18404d4b7fd374314b7659d7084e5

SHA1
0760777c3c79ce5caebffa7fe189417a8b4e05cb

SHA256
00ac3554f9e0a5cd37095dd7d1beefc88148a8e3892950e39cdd2f26634c0352

SHA512
1ef3194fa27819bc63f617ac60cc79de768a8180cfa07639b5c9c6a063439800559278f204b73c2ce67255f4d1d285ebb91bc9bf09d9863fe33910f425151b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe

Filesize
184KB

MD5
53d04b7f7878b892d9b9c22bcc5fd814

SHA1
9c77419b81481b56b120789dff96ac9b2f8b6925

SHA256
0804342141723a4258da2ca2c57969252c99e8d12f11425c0aca8c2407919aa2

SHA512
cf67116078f491c1861f89f922fc100d64b873ecb623a7e1df8a7075db86ae9467038188670e314e01272acc88c53b8dd73aad3b59229a73c088e00c3244ea98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe

Filesize
184KB

MD5
cf50f072125a0bc379017efbc25af0a4

SHA1
7bd69c59956eef7f1d29d234d4d9d49e29e92507

SHA256
c1f241da3c5c0e8e7a316a11de45ce98b102ceeba2c6b405fb76dbd775319b5f

SHA512
1ad76392eabfa19d36283d42a56b98819a134d5fb7f37d7966c6d61d827312c0baf2907c25115053542e00be6b822ab39745b1316ab38a3d6fd33a19cfad8e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe

Filesize
184KB

MD5
ba76fcddf769f736d5bf3479282f9437

SHA1
b77d402d29772dad3d902a2385020c1f198ca37a

SHA256
518e2af86189e10f229c3a39909af42359a8c02791d02ae493cd64b405f56c76

SHA512
9ce8a302a17584853b8f2595c9eeea2086ab0a7f6dfae6f6e2cfc7f54886490d27f8f7d98e80917b66a6af1bc15c1e0c240f96e17036c172d5f623539aa121e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe

Filesize
184KB

MD5
11d23921076b3c05cf152329d443128f

SHA1
f0451e43a1113dbfd37aad184c4d9a511aecf5b1

SHA256
0f50d11a6572bd76709df37d1c49ee2aa8fccc9d53bfa144fbc51cf2ef3d0b14

SHA512
c3bfebfa55940d3761e45536e72749eedc4892f543bfe47266d296f0066aaa70580cae8ebb2f9df1a740fe8c8a4889f11d0db14dc2d885ef1db3ee6d0271cbcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe

Filesize
184KB

MD5
eddc35c90727d1369f2d534f36e8f2cc

SHA1
c700350a55c92ad8f16934288db9ab3d518b82ca

SHA256
5b2c33fbfb6fe8169a2d6082d9ef6fab024c813562f965d6b2180c0f3dbbfba2

SHA512
5db4a5be8341639f7ba3435b4514318b6fbc3fc31563529b03165030031e1d350d16d3f6feb4be943678b3b41d5538b227bf6aca2270e0437d6d134d13f8d885

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe

Filesize
184KB

MD5
e0fb5640444f364ab0b6763ce3b68124

SHA1
fff47a3577ad4312d47ac2201bda66fdb06922c1

SHA256
576147d288288ec4149f7621ef23e3696c7fd15f371aaf27c87e0226675a60e8

SHA512
402ea148f4a97c699e460235ea529cbb7b979a656c4f46d44a8244997bc73d4533b20a43a85f8bb6c5c25ee80e8c252db9aac5ee07242700bf23a3a6b29b3e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe

Filesize
184KB

MD5
469a5fa961c458a6ed699335cfa2209b

SHA1
bb10fd7ba23b91575a78c6ca1a8c3df9c1265943

SHA256
b32743c181883100443448321c8645052ee5c8ac7348cdd24a86cd5a5ea016ac

SHA512
368245d5095629c652998e75c8b84bdf2fa12770a760a41804f23667b41e1bd058e802fa593f924e22a1ce0b408e7fe7cb196984f92f097e4227029b2a12e13d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe

Filesize
184KB

MD5
54705523635f52ee357a43219fd9ca02

SHA1
ee253fc0087de724b1de4f5a08d0100189a8b4ec

SHA256
60211c6f6093ce28ff4f9939adde2ea54323b3175b5184e34d14b32fc2e7b2a1

SHA512
1380487a22a8b36c0acf8bcae9309cca24e8232389b4469377668bdf144e164a50d2c5d220bfe9919a8ae8c34b17371b2212539b4eda230c81961d7f0e3af834

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe

Filesize
184KB

MD5
9cc34b0715804e9c9a1755bef30b797e

SHA1
f76fb8fc33e05c9a2650bb78e11a1ac38dafa2f1

SHA256
472a99e97b4abc1227b772695f99e75a268c2eecc69eb9d1f31a523d670bdae5

SHA512
ff10d4dfdee3bfa7d655167ca281cd78a33ece15b796851738b6915bfef1ab6daf6feb28f39f18e729b971273c742c1b745d381970acca85162e466cb326014e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5969.exe

Filesize
184KB

MD5
c42fa006c0af8e50cd3d1da8c36a58b7

SHA1
e08ad76c03d4a8bce0215b2d97208a27757c9662

SHA256
f068f89e7688b2ed7487680bbd9a20b70fbb24d6a67f4e534e6ae392842203f3

SHA512
3f5ef8c61bbd72a5be1b58c0d2e3c6a8683198bd5453980fd8060ef93f6059c80cb6653587ab63da5e65d1d95ae382ab7a456db8ab7f076f8cbe5e3a94733458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe

Filesize
184KB

MD5
91c0edf60c2bb627a830cb26eb365465

SHA1
615e2862ebfe6d84b778cc9fef26b39a25b2e6f4

SHA256
306d713f1629cc1d7ca8a9d835b8d023d4db41df22b8c1b744e6153a508c8734

SHA512
4c1a03172a8e128445ef39fe46f21027e2ac22f51939d9fea1f75896b9085ca167c52544695a01854400b655864485482c4e64783bebb275ea48ffd082a17927

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe

Filesize
184KB

MD5
9e1e6ef059c0103159ca51479cef42ab

SHA1
3cc754317599ad51ef55f1970c08d55bfcd02922

SHA256
d5af63fbb0556843aad5323b635a13460135d687a396217378080f3a3bd43fe1

SHA512
04424c5b34aa59549ba28ae90c5e6e4e48779d542320acd65912b03ead73940a3e9161bf6c105d7e969c78ab91590ad6142484a16e70a228e68f73c0ce473f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe

Filesize
184KB

MD5
511600eff39e00a6b3eda8048ee1f1f8

SHA1
53fb9960073d88696ad91f3ddc6305a2b03be243

SHA256
d63a4e8ef2d9799232ed7f7d2bf6b93a17ff77eb7662281c6f0c58d0a8386f6c

SHA512
0d4fdf9a419d6d18abfb66aaff54462b071e1dbbe6cfa728be3d61515ebd5c9b9662330dc4946aebf7ce9a62d40d4ba57711bbef3d8557407914404f75ee2328

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe

Filesize
184KB

MD5
f614910b49a1d2c43b9054b340f8e2c6

SHA1
13752c88c209d5b53d176fa2857299dada310400

SHA256
cee14944dea8c17f9f4eec010fcaffc8f74c9a6aff25601f28ae7b66b680fb65

SHA512
8f278594f216cfa2a00163a15ef00a56a6aea11d07173fc8c2b70c43166983d1046aee3934fe96be8d41796181b71b0e6256c4fc48eedbcc798115e3a34ab2c2

Download Submit
memory/5676-3029-0x00007FFB37BB0000-0x00007FFB37C33000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads