a58de5df36159147f909270657fe9c783dadbc829d164d19f572706d4cae6029

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
Size

468KB
MD5

4241e03d62dca1e9a3d350b67c6de850
SHA1

935b0557b214ee3ca48502022c427763e848c433
SHA256

a58de5df36159147f909270657fe9c783dadbc829d164d19f572706d4cae6029
SHA512

5353564af59825e14ddfd567d6f91d5123c0e1a1a304125a8e4895d0811d1cb8ec94887f704a64231e2e3637914ae190412abc55d032ec9c991b7ea40a9cc829
SSDEEP

3072:KbAUogI3I05UtbYfPztjRf8/ECh6PIpwnmHexVTjoaU8ASPwX0le:KbHoG8UtEPJjRfn0Kzoa9TPwX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2752	Unicorn-55951.exe
2576	Unicorn-29392.exe
2844	Unicorn-52505.exe
2724	Unicorn-52033.exe
2736	Unicorn-37643.exe
2696	Unicorn-17777.exe
2592	Unicorn-47849.exe
2356	Unicorn-1846.exe
1496	Unicorn-36657.exe
1880	Unicorn-57845.exe
1912	Unicorn-37979.exe
1516	Unicorn-64622.exe
344	Unicorn-53496.exe
2396	Unicorn-18951.exe
2384	Unicorn-12820.exe
1952	Unicorn-13522.exe
1088	Unicorn-33388.exe
1328	Unicorn-4607.exe
1044	Unicorn-12775.exe
1292	Unicorn-423.exe
2428	Unicorn-2469.exe
2332	Unicorn-14721.exe
3000	Unicorn-13959.exe
1920	Unicorn-49267.exe
1604	Unicorn-18806.exe
796	Unicorn-37834.exe
1624	Unicorn-26974.exe
920	Unicorn-58255.exe
908	Unicorn-12583.exe
3024	Unicorn-54171.exe
380	Unicorn-45723.exe
900	Unicorn-10912.exe
2884	Unicorn-55929.exe
1544	Unicorn-7383.exe
2988	Unicorn-39501.exe
2256	Unicorn-27803.exe
2200	Unicorn-47669.exe
2616	Unicorn-35971.exe
2828	Unicorn-64005.exe
2248	Unicorn-37098.exe
2124	Unicorn-41447.exe
2792	Unicorn-11275.exe
2544	Unicorn-13434.exe
1908	Unicorn-13434.exe
1564	Unicorn-51567.exe
1632	Unicorn-40631.exe
1460	Unicorn-46107.exe
2772	Unicorn-42023.exe
2376	Unicorn-22157.exe
2532	Unicorn-11296.exe
1944	Unicorn-14419.exe
2128	Unicorn-33754.exe
2208	Unicorn-39885.exe
1612	Unicorn-48053.exe
1252	Unicorn-9158.exe
2888	Unicorn-43969.exe
2416	Unicorn-62343.exe
320	Unicorn-34217.exe
964	Unicorn-50959.exe
356	Unicorn-39261.exe
1092	Unicorn-9926.exe
1096	Unicorn-56989.exe
292	Unicorn-34166.exe
3020	Unicorn-22733.exe

Loads dropped DLL 64 IoCs

pid	Process
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
2752	Unicorn-55951.exe
2752	Unicorn-55951.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
2576	Unicorn-29392.exe
2576	Unicorn-29392.exe
2844	Unicorn-52505.exe
2844	Unicorn-52505.exe
2752	Unicorn-55951.exe
2752	Unicorn-55951.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
2724	Unicorn-52033.exe
2696	Unicorn-17777.exe
2724	Unicorn-52033.exe
2696	Unicorn-17777.exe
2592	Unicorn-47849.exe
2592	Unicorn-47849.exe
2576	Unicorn-29392.exe
2752	Unicorn-55951.exe
2844	Unicorn-52505.exe
2736	Unicorn-37643.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
2736	Unicorn-37643.exe
2576	Unicorn-29392.exe
2844	Unicorn-52505.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
2752	Unicorn-55951.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2696	Unicorn-17777.exe
1496	Unicorn-36657.exe
2696	Unicorn-17777.exe
1496	Unicorn-36657.exe
1912	Unicorn-37979.exe
1912	Unicorn-37979.exe
1516	Unicorn-64622.exe
1516	Unicorn-64622.exe
2844	Unicorn-52505.exe
2844	Unicorn-52505.exe
344	Unicorn-53496.exe
344	Unicorn-53496.exe
2384	Unicorn-12820.exe
2384	Unicorn-12820.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
2752	Unicorn-55951.exe
2752	Unicorn-55951.exe
1880	Unicorn-57845.exe
1880	Unicorn-57845.exe
2592	Unicorn-47849.exe
2592	Unicorn-47849.exe
2396	Unicorn-18951.exe
2396	Unicorn-18951.exe
2736	Unicorn-37643.exe

Program crash 18 IoCs

pid	pid_target	Process	procid_target
2920	2576	WerFault.exe	29
1168	2724	WerFault.exe	31
1420	1912	WerFault.exe	38
2960	2356	WerFault.exe	35
2468	3024	WerFault.exe	58
1468	2256	WerFault.exe	65
1104	2988	WerFault.exe	64
2172	1328	WerFault.exe	46
3184	908	WerFault.exe	57
3176	1460	WerFault.exe	76
3200	2376	WerFault.exe	77
3780	2208	WerFault.exe	82
4000	2484	WerFault.exe	136
4520	996	WerFault.exe	122
4972	3060	WerFault.exe	132
4980	1228	WerFault.exe	116
4988	2768	WerFault.exe	113
844	2980	WerFault.exe	123

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
2752	Unicorn-55951.exe
2576	Unicorn-29392.exe
2844	Unicorn-52505.exe
2724	Unicorn-52033.exe
2736	Unicorn-37643.exe
2696	Unicorn-17777.exe
2592	Unicorn-47849.exe
1496	Unicorn-36657.exe
1912	Unicorn-37979.exe
1516	Unicorn-64622.exe
344	Unicorn-53496.exe
2384	Unicorn-12820.exe
2356	Unicorn-1846.exe
1880	Unicorn-57845.exe
2396	Unicorn-18951.exe
1952	Unicorn-13522.exe
1088	Unicorn-33388.exe
1328	Unicorn-4607.exe
1044	Unicorn-12775.exe
1292	Unicorn-423.exe
2428	Unicorn-2469.exe
2332	Unicorn-14721.exe
3000	Unicorn-13959.exe
1920	Unicorn-49267.exe
1604	Unicorn-18806.exe
796	Unicorn-37834.exe
1624	Unicorn-26974.exe
908	Unicorn-12583.exe
920	Unicorn-58255.exe
3024	Unicorn-54171.exe
380	Unicorn-45723.exe
900	Unicorn-10912.exe
2884	Unicorn-55929.exe
1544	Unicorn-7383.exe
2988	Unicorn-39501.exe
2256	Unicorn-27803.exe
2200	Unicorn-47669.exe
2616	Unicorn-35971.exe
2828	Unicorn-64005.exe
2248	Unicorn-37098.exe
2124	Unicorn-41447.exe
2792	Unicorn-11275.exe
2544	Unicorn-13434.exe
1908	Unicorn-13434.exe
1564	Unicorn-51567.exe
1460	Unicorn-46107.exe
1632	Unicorn-40631.exe
2376	Unicorn-22157.exe
2772	Unicorn-42023.exe
2532	Unicorn-11296.exe
2128	Unicorn-33754.exe
1944	Unicorn-14419.exe
2208	Unicorn-39885.exe
2888	Unicorn-43969.exe
1252	Unicorn-9158.exe
1612	Unicorn-48053.exe
2416	Unicorn-62343.exe
320	Unicorn-34217.exe
964	Unicorn-50959.exe
356	Unicorn-39261.exe
1092	Unicorn-9926.exe
1096	Unicorn-56989.exe
292	Unicorn-34166.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2752	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	28
PID 1968 wrote to memory of 2752	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	28
PID 1968 wrote to memory of 2752	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	28
PID 1968 wrote to memory of 2752	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	28
PID 2752 wrote to memory of 2576	2752	Unicorn-55951.exe	29
PID 2752 wrote to memory of 2576	2752	Unicorn-55951.exe	29
PID 2752 wrote to memory of 2576	2752	Unicorn-55951.exe	29
PID 2752 wrote to memory of 2576	2752	Unicorn-55951.exe	29
PID 1968 wrote to memory of 2844	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	30
PID 1968 wrote to memory of 2844	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	30
PID 1968 wrote to memory of 2844	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	30
PID 1968 wrote to memory of 2844	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	30
PID 2576 wrote to memory of 2724	2576	Unicorn-29392.exe	31
PID 2576 wrote to memory of 2724	2576	Unicorn-29392.exe	31
PID 2576 wrote to memory of 2724	2576	Unicorn-29392.exe	31
PID 2576 wrote to memory of 2724	2576	Unicorn-29392.exe	31
PID 2844 wrote to memory of 2736	2844	Unicorn-52505.exe	32
PID 2844 wrote to memory of 2736	2844	Unicorn-52505.exe	32
PID 2844 wrote to memory of 2736	2844	Unicorn-52505.exe	32
PID 2844 wrote to memory of 2736	2844	Unicorn-52505.exe	32
PID 2752 wrote to memory of 2696	2752	Unicorn-55951.exe	33
PID 2752 wrote to memory of 2696	2752	Unicorn-55951.exe	33
PID 2752 wrote to memory of 2696	2752	Unicorn-55951.exe	33
PID 2752 wrote to memory of 2696	2752	Unicorn-55951.exe	33
PID 1968 wrote to memory of 2592	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	34
PID 1968 wrote to memory of 2592	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	34
PID 1968 wrote to memory of 2592	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	34
PID 1968 wrote to memory of 2592	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	34
PID 2724 wrote to memory of 2356	2724	Unicorn-52033.exe	35
PID 2724 wrote to memory of 2356	2724	Unicorn-52033.exe	35
PID 2724 wrote to memory of 2356	2724	Unicorn-52033.exe	35
PID 2724 wrote to memory of 2356	2724	Unicorn-52033.exe	35
PID 2696 wrote to memory of 1496	2696	Unicorn-17777.exe	36
PID 2696 wrote to memory of 1496	2696	Unicorn-17777.exe	36
PID 2696 wrote to memory of 1496	2696	Unicorn-17777.exe	36
PID 2696 wrote to memory of 1496	2696	Unicorn-17777.exe	36
PID 2592 wrote to memory of 1880	2592	Unicorn-47849.exe	37
PID 2592 wrote to memory of 1880	2592	Unicorn-47849.exe	37
PID 2592 wrote to memory of 1880	2592	Unicorn-47849.exe	37
PID 2592 wrote to memory of 1880	2592	Unicorn-47849.exe	37
PID 2736 wrote to memory of 2396	2736	Unicorn-37643.exe	41
PID 2736 wrote to memory of 2396	2736	Unicorn-37643.exe	41
PID 2736 wrote to memory of 2396	2736	Unicorn-37643.exe	41
PID 2736 wrote to memory of 2396	2736	Unicorn-37643.exe	41
PID 2576 wrote to memory of 1912	2576	Unicorn-29392.exe	38
PID 2576 wrote to memory of 1912	2576	Unicorn-29392.exe	38
PID 2576 wrote to memory of 1912	2576	Unicorn-29392.exe	38
PID 2576 wrote to memory of 1912	2576	Unicorn-29392.exe	38
PID 2844 wrote to memory of 1516	2844	Unicorn-52505.exe	40
PID 2844 wrote to memory of 1516	2844	Unicorn-52505.exe	40
PID 2844 wrote to memory of 1516	2844	Unicorn-52505.exe	40
PID 2844 wrote to memory of 1516	2844	Unicorn-52505.exe	40
PID 1968 wrote to memory of 344	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	42
PID 1968 wrote to memory of 344	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	42
PID 1968 wrote to memory of 344	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	42
PID 1968 wrote to memory of 344	1968	4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe	42
PID 2752 wrote to memory of 2384	2752	Unicorn-55951.exe	39
PID 2752 wrote to memory of 2384	2752	Unicorn-55951.exe	39
PID 2752 wrote to memory of 2384	2752	Unicorn-55951.exe	39
PID 2752 wrote to memory of 2384	2752	Unicorn-55951.exe	39
PID 2576 wrote to memory of 2920	2576	Unicorn-29392.exe	43
PID 2576 wrote to memory of 2920	2576	Unicorn-29392.exe	43
PID 2576 wrote to memory of 2920	2576	Unicorn-29392.exe	43
PID 2576 wrote to memory of 2920	2576	Unicorn-29392.exe	43

C:\Users\Admin\AppData\Local\Temp\4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4241e03d62dca1e9a3d350b67c6de850_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29392.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63294.exe
        8⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
        9⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 216
        9⤵
        Program crash
        
        PID:4520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 236
        8⤵
        Program crash
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        7⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        8⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 236
        8⤵
        Program crash
        
        PID:844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 240
        7⤵
        Program crash
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        8⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 236
        8⤵
        Program crash
        
        PID:4972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 236
        7⤵
        Program crash
        
        PID:3200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 240
        6⤵
        Program crash
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        7⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 236
        7⤵
        Program crash
        
        PID:3780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 236
        6⤵
        Program crash
        
        PID:2468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 240
        5⤵
        Program crash
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39501.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        8⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 216
        8⤵
        Program crash
        
        PID:4988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 236
        7⤵
        Program crash
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
        6⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        7⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 216
        7⤵
        Program crash
        
        PID:4980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 240
        6⤵
        Program crash
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        6⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        7⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 236
        7⤵
        Program crash
        
        PID:4000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 216
        6⤵
        Program crash
        
        PID:1468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 240
        5⤵
        Program crash
        
        PID:1420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10912.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        8⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        9⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        9⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        9⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        9⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        9⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        8⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        8⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39578.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31559.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        7⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        6⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        6⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        6⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        7⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        7⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54741.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        6⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        5⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        5⤵
        
        PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45723.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19039.exe
        7⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54741.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46687.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
        5⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        5⤵
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        5⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29454.exe
        5⤵
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
        5⤵
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        5⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
      4⤵
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
      4⤵
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
      4⤵
      PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14721.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
        6⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        7⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10200.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40281.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        5⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16183.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59494.exe
        5⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        6⤵
        
        PID:596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4370.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        5⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        6⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        5⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
      4⤵
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        5⤵
        
        PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8815.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
      4⤵
      PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        6⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        6⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        6⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        5⤵
        
        PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
      4⤵
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        5⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        5⤵
        
        PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
      4⤵
      PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
      4⤵
      PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
      4⤵
      PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
    3⤵
    PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
    3⤵
    PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
    3⤵
    PID:6612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
        8⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44684.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        7⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        6⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        7⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        6⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47996.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        6⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        6⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        6⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        7⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        6⤵
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        6⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        5⤵
        
        PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        5⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22475.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31812.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
      4⤵
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
      4⤵
      PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53759.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        7⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5130.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
        7⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53455.exe
        6⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
        5⤵
        
        PID:484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54685.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        6⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        5⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        6⤵
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62961.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
        5⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        5⤵
        
        PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63002.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        5⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
        5⤵
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        6⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        6⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        5⤵
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
      4⤵
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
      4⤵
      PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
      4⤵
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
      4⤵
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        5⤵
        
        PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      4⤵
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
      4⤵
      PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
      4⤵
      PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
    3⤵
    PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28552.exe
      4⤵
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
      4⤵
      PID:7864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33706.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
    3⤵
    PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exe
    3⤵
    PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10862.exe
    3⤵
    PID:7660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43969.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        6⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22644.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
        6⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        6⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        5⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        6⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        5⤵
        
        PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        6⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37052.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61782.exe
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        5⤵
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
      4⤵
      PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
      4⤵
      PID:7912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        5⤵
        
        PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      4⤵
      PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
      4⤵
      PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      4⤵
      PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      4⤵
      PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
    3⤵
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
      4⤵
      PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
      4⤵
      PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      4⤵
      PID:7724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8339.exe
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
    3⤵
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
    3⤵
    PID:5860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
    3⤵
    PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
    3⤵
    PID:6604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        5⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        6⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        5⤵
        
        PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        5⤵
        
        PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
      4⤵
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
      4⤵
      PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
      4⤵
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
      4⤵
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
      4⤵
      PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
    3⤵
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
      4⤵
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      4⤵
      PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
      4⤵
      PID:7244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
    3⤵
    PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
    3⤵
    PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
    3⤵
    PID:7756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
      4⤵
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41911.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
      4⤵
      PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
    3⤵
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46663.exe
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
      4⤵
      PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
      4⤵
      PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
    3⤵
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
    3⤵
    PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
    3⤵
    PID:7948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
    3⤵
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
      4⤵
      PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61220.exe
    3⤵
    PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
    3⤵
    PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
    3⤵
    PID:7572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36804.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36804.exe
  2⤵
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
    3⤵
    PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
    3⤵
    PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
    3⤵
    PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
    3⤵
    PID:7776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
  2⤵
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43041.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43041.exe
  2⤵
  PID:4672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
  2⤵
  PID:5056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
  2⤵
  PID:5624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
  2⤵
  PID:7008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
  2⤵
  PID:7552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe

Filesize
468KB

MD5
dafc783710b94a00e972397da5100bcc

SHA1
eeffc7cc4bea3e31ce6642b8fe2dc804ab29b27e

SHA256
024e93b5ee1f8105c601140ade1d09e3b39e985b906a86ac6fa9a8f9face0ba1

SHA512
69777baa82f930e9eb3a938bbec1fd3e29b6b32c1a54d702569af8fc932c01aa722cac0190668dd9d1c2c29888b67e56958e9e50588677d02fd1369a2c6e66c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29392.exe

Filesize
468KB

MD5
fcec838f825798162b96cd2a57cc78a1

SHA1
d40634c9a9433f8f87a08b69aca520080dce7bb8

SHA256
e0b07ce4c06db79a50a133571c139568ec3ca2e73e8305c8ef4c85d4edb3819e

SHA512
b31c43d97247a399d52a9200cff2630bf3ca5e114b9d3b4b372bd562b589fa71f7e47f1543c0cee097378eddf6467b6a6a63619fe32635a3e097d5e25b9d2ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe

Filesize
468KB

MD5
3f315b57db3631fb5c4a3030423377a3

SHA1
f41fe0276c7d51627dd957fb7f9c0387878154a8

SHA256
44f283fb0e4557b2471a00d0679a401164a7965dc7d38863ebae4f24e89b26e0

SHA512
e1a1597dab1210ff4facc4cb94eefde8d1f7dc6c79f9aafe4125478e894dcbc7a7bc013da529cd82dbb583abdbbadb658494b8b033613fd6d065cf2ddfb72ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe

Filesize
468KB

MD5
22016fc5396d4358912127c559bfd79f

SHA1
03655d08aa3dbd9f06ae24dbe9ebad4b4a3147fb

SHA256
5c8e0aaa114fd6b8750cc4ed0758200096468c633e6d639f7ea6f0fe044ce255

SHA512
c5a3f0cc39e63279731c021a6645c239c38121239153ab3fa5dd53abbfbb148718acfb1b8f9798a3e235e544e1497c569d88a4301aff82bba8e2b1601b4e0aaa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe

Filesize
468KB

MD5
c060f618056aa9c21e853b998e1ad0b7

SHA1
4f0d6807474e38a15f2be290e5b8e21ed50eadaa

SHA256
9cfe4f6f43582a4ffc1afd20f185bc97f0f83a29241adb22524596e803c2b683

SHA512
db53d58e897797d2aa0ce9334971d9983c5a11571ffa45c4b050f2665b0174dd95385516f7ed936e5921225a8ea483893631f77f80e819b5861fa5c5f165c6bd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe

Filesize
468KB

MD5
4f9628a1b62c301c508e23f1e5c88ca7

SHA1
22a7770c9b8a35c4ecb394fb13d8b01ffd7a6f1d

SHA256
e484087db291e94a1baaf35ab821412df9da4550b74200d93cd39d24b6ebedf4

SHA512
5391f803223c6828e92abd978340996b607776d0f805672aa80823ca4ca67fd82d352bc50a7fa62336261e28729c09964edf3330fcc32b04c9793e5945857d30

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe

Filesize
468KB

MD5
20c31fa2c4c154831e375a6cfbc9c5da

SHA1
099192fefaf002f7a1bac2db1f68b4d3d35e46b5

SHA256
18fdb761740aa95cf6b36d13ba66a9e7168125df4cf9d812deb55fa839c5f240

SHA512
668ed60ec61e52b26d6e00848d102eb43b3dcc5898e942b85fdcac1caee9b3b9119464ce51b34657e89186928b0b31137524033b3bd11e4b242b9e7c21b3e13d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe

Filesize
468KB

MD5
9540a6c94018ced2a226ff1595164962

SHA1
beca7d5956e7ab95ef231dd57f3dffe754e2236e

SHA256
dffaf15bae9b37dbcde584ce57b391984d28cf231165ac8e91dc265b72842919

SHA512
82cf3986f5d6f51692b6900b3b8911de2ca84978749760a6eb52e6a5d426b49e9e3a6c4072f5cb3d23ccd7fc684641b46431428143c80986966c2bbcf4d9909a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe

Filesize
468KB

MD5
4cc4a3368774448647373bed48e042a6

SHA1
5a8274ff9df19879e2dc8e5116b521561366dea0

SHA256
e97e64b074e52a880895e9fa1126fef14aff07b1d23910e8994e92f68782ae68

SHA512
ef0f652c01c98bcfe7b6ecf59c4dae44c2ce918177adb51992b5cc42653778358c172b971accc613480b07eae29d75ae4aebd6ea4c3c5475e83e48db3b3d037d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe

Filesize
468KB

MD5
7d52b7a9cf886cdd5d724f5bb62ec03b

SHA1
14c89f523bfdd533dca44a860fc2ccf2ac03fa57

SHA256
c3668aff7f98557b309202cabccaaf840c49fabe703a083529e834d7c7361711

SHA512
1159b758fc4ff592105c3ef06f5e8360bbbd93b5608c1756a502f76e113d450afa7f21ba3bcc8ccbbd6686add209fb0dc1f11227cd3e16148ab230dc7f9e831d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe

Filesize
468KB

MD5
b95292dfb31ac42b510e0b483441b51a

SHA1
94a37d1b3cbb2b3c551359bef8715f66557fb465

SHA256
0b1b4e2f2ec4e60dc6f9941f61c8ffa444c697eca1426d9a7d5b553b3def5668

SHA512
af5376ce4b531c03c2081f7c62366a931829c46ca42234068c729b065d66c260f15cfd1af85ea272b37f9877dc5f1e439fcbc84e4ac306756586c66e4a3bb2a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe

Filesize
468KB

MD5
e64bd65910e99450c1df383b508c27c4

SHA1
f97fd830ce4baef8745c29162f270c96ba8ce8d3

SHA256
6f846a7d251dab2036babb54fa406275c7951686b57607b3daf951502e3c6358

SHA512
13d3c4006379242ecb019edebe6f18912564c6d6adf474a01b377d0bfcb9ce00b57c1655057f2ece953aa87ceb7fa6cab3abb1a62f5d730049345b55ff282fc7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe

Filesize
468KB

MD5
93bd534fe4adcb829aa8925565b63b61

SHA1
d755338ef8b5bd9b937a1012bdb92bff92d0011e

SHA256
45ee034526a0a268f0e81748904ae575551ee6636e5d8a8bc02a98e496ac5ea1

SHA512
ff726d7769b6606664b895c3addf067c1ae103ff2f9eef4de5c1d05f07e8df3195933aab8a1b2f805ca51030e67ef1a5f13b337ba434fe4de37887cfe2f71a43

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe

Filesize
468KB

MD5
159197879b0694cb8a8bdcc0959f87b9

SHA1
aa2fce085087679c4b731f27d8d311aa2a62670b

SHA256
a0847b5ee4ffb0290add8888d8927a819794832427d4e59930095ed0e23a32ef

SHA512
43c1bd8249c1101ce104fd878e8201a00fbedfe257e2023ce3aaa614b3ddca34ee17987f8d42c3976a2578371121b98c0bacb17d7ece903ed43e2c28c2304b86

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe

Filesize
468KB

MD5
c3ab624768b61656f5446bae500d948a

SHA1
2c770473b4572679a367f584c414b441cdf13107

SHA256
20599a8b7e6dddb39bd343ee7d7ea8d4eaf029afb45afd16982429903ecaab6b

SHA512
24dcf93954c4730e18a3df19fdc1e73200261825f53e5f8e2f88077accd87708eb2a58d7a097f55ec71a568a14548454ca1ad04f2b2dcc57b99ee88462ce4075

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe

Filesize
468KB

MD5
bf4aa18985dd83e9570fa1da5c1cd7af

SHA1
54436b97ec8623296d38eef83f8c74ea624e3b67

SHA256
fb60fa12b694b1f67d5b88a356d79b71d7f23159bcbd0ec5adf926206aac697d

SHA512
db7476cf2105de2f2ec5cced8dfadf135b525bd37d69f1c3f784631663d87fb638740347e52e4e804c6b6aa210997b855e7128b5543f252d88cc6ad682618750

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe

Filesize
468KB

MD5
7c328e9b9b91d33d462e041b770b8c70

SHA1
64bf0be3b3d8e07cb5414e3b319b05277f930818

SHA256
f7b17011fd0459fd8e7f0ef479e5d22f5907c67cd49bb420bb2c13512ee7ad33

SHA512
28f38cc913a84f1d471851d63b429c2c6c68dbf940b43de89cf924583daf3cd40c5186de6a667e4b355225eab7715fc11d3ad988974eb93515421ebcc6591dfd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe

Filesize
468KB

MD5
20124806b92667cf68f9ba321c28eb1c

SHA1
2759428124744d86a8a8379722adf314b97c0c46

SHA256
377796055d1bc9b51f315662bd888415a60272e0f93efe67ceba3268ad9fa145

SHA512
ac039e290101ea75894348c1d3e8e538244132b8543a4efbd62db1f82db5a850529ce7be31da6eba4918ad76d52447a7f1e12b505713010509750f689e6820ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe

Filesize
468KB

MD5
89c75f7cc319bb5c119503ed4a793de8

SHA1
2baecc1ac04a6209daf27f5436e36ce40b2dfc44

SHA256
b447a06246cbe85da3553ff0cd53cedd82062dca09e1b58256eb756f9420eac6

SHA512
238c6a92ed397405eca73a68fc8f31a28f6dee5c514a36ccf6cbac1503c008176481b6659bfd6f1842e39e7d1fbf52ae7b64cd00684ad50c6a25741c68aed407

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads