5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe
Size

184KB
MD5

53d1da71535f3cfb5ea6219ed3b00f05
SHA1

d88c73ac9d022a68fcbc89d063f123be73853599
SHA256

5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d
SHA512

fa80d645cf61b8286a571a1c34fed817e04a69ea5ad4cc5abb818918f808d74324a9505d4d4c60d61b7c18382d36424379b8fbc2fec438f6acd017aee877696f
SSDEEP

3072:/YyH/DoR/ZA0dN3wX9thbwWGlvMqPviuN:/Y2ogwN3Sh0WGlEqPviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2464	Unicorn-50096.exe
3064	Unicorn-22468.exe
2424	Unicorn-41496.exe
2572	Unicorn-3007.exe
2908	Unicorn-36426.exe
2492	Unicorn-60376.exe
4320	Unicorn-15351.exe
2600	Unicorn-651.exe
2524	Unicorn-50407.exe
1572	Unicorn-19126.exe
4092	Unicorn-19126.exe
1960	Unicorn-34070.exe
4524	Unicorn-47806.exe
3464	Unicorn-41492.exe
3092	Unicorn-14584.exe
4632	Unicorn-49406.exe
4016	Unicorn-33624.exe
3632	Unicorn-45322.exe
4912	Unicorn-57474.exe
2764	Unicorn-63604.exe
4368	Unicorn-36962.exe
4904	Unicorn-24710.exe
3544	Unicorn-35570.exe
3312	Unicorn-39654.exe
3556	Unicorn-39654.exe
4328	Unicorn-51352.exe
1824	Unicorn-51352.exe
1236	Unicorn-6327.exe
4856	Unicorn-3527.exe
2320	Unicorn-12192.exe
1936	Unicorn-15647.exe
4292	Unicorn-37922.exe
2504	Unicorn-28362.exe
4840	Unicorn-50942.exe
604	Unicorn-55026.exe
2208	Unicorn-18632.exe
1628	Unicorn-32367.exe
4236	Unicorn-48804.exe
4972	Unicorn-59665.exe
4568	Unicorn-26054.exe
216	Unicorn-2104.exe
1412	Unicorn-9717.exe
2100	Unicorn-42196.exe
1228	Unicorn-6209.exe
4848	Unicorn-51061.exe
5044	Unicorn-26365.exe
4488	Unicorn-26630.exe
1248	Unicorn-57356.exe
4628	Unicorn-61440.exe
4492	Unicorn-40258.exe
3244	Unicorn-4163.exe
3948	Unicorn-10293.exe
4776	Unicorn-60049.exe
3264	Unicorn-14377.exe
4908	Unicorn-65424.exe
2788	Unicorn-6017.exe
440	Unicorn-51689.exe
5048	Unicorn-39436.exe
4952	Unicorn-24611.exe
2872	Unicorn-10485.exe
4208	Unicorn-25430.exe
1396	Unicorn-11153.exe
3356	Unicorn-25452.exe
560	Unicorn-31482.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4372	1236	WerFault.exe	115
3292	5436	WerFault.exe	245
7344	6092	WerFault.exe	227
4768	10512	WerFault.exe	522
5804	5220	WerFault.exe	969
13084	9544	Process not Found	1197

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
8720	svchost.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
19316	Process not Found
13968	Process not Found
13972	Process not Found
13984	Process not Found
13988	Process not Found
13992	Process not Found
13996	Process not Found
19320	Process not Found
14012	Process not Found
7420	Process not Found
19328	Process not Found
19268	Process not Found
19332	Process not Found
19352	Process not Found
19240	Process not Found
19360	Process not Found
4552	Process not Found
4504	Process not Found
14348	Process not Found
14536	Process not Found
14540	Process not Found
19364	Process not Found
14388	Process not Found
19372	Process not Found
14552	Process not Found
14556	Process not Found
872	Process not Found
776	Process not Found
4268	Process not Found
2716	Process not Found
968	Process not Found
4132	Process not Found
4196	Process not Found
844	Process not Found
4276	Process not Found
4300	Process not Found
4944	Process not Found
396	Process not Found
2084	Process not Found
14420	Process not Found
14424	Process not Found
14568	Process not Found
14576	Process not Found
14580	Process not Found
19376	Process not Found
14584	Process not Found
14588	Process not Found
14592	Process not Found
14596	Process not Found
14600	Process not Found
14604	Process not Found
14608	Process not Found
19384	Process not Found
14628	Process not Found
14632	Process not Found
14636	Process not Found
14640	Process not Found
14648	Process not Found
14652	Process not Found
14656	Process not Found
14664	Process not Found
14688	Process not Found
14692	Process not Found
14700	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3148	dwm.exe
Token: SeChangeNotifyPrivilege	3148	dwm.exe
Token: 33	3148	dwm.exe
Token: SeIncBasePriorityPrivilege	3148	dwm.exe
Token: SeCreateGlobalPrivilege	11872	Process not Found
Token: SeChangeNotifyPrivilege	11872	Process not Found
Token: 33	11872	Process not Found
Token: SeIncBasePriorityPrivilege	11872	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe
2464	Unicorn-50096.exe
3064	Unicorn-22468.exe
2424	Unicorn-41496.exe
2572	Unicorn-3007.exe
2908	Unicorn-36426.exe
2492	Unicorn-60376.exe
4320	Unicorn-15351.exe
2600	Unicorn-651.exe
2524	Unicorn-50407.exe
1572	Unicorn-19126.exe
4092	Unicorn-19126.exe
3464	Unicorn-41492.exe
1960	Unicorn-34070.exe
4524	Unicorn-47806.exe
3092	Unicorn-14584.exe
4632	Unicorn-49406.exe
4016	Unicorn-33624.exe
3632	Unicorn-45322.exe
4368	Unicorn-36962.exe
2764	Unicorn-63604.exe
4912	Unicorn-57474.exe
4856	Unicorn-3527.exe
4904	Unicorn-24710.exe
3312	Unicorn-39654.exe
2320	Unicorn-12192.exe
1236	Unicorn-6327.exe
1824	Unicorn-51352.exe
4328	Unicorn-51352.exe
3556	Unicorn-39654.exe
4292	Unicorn-37922.exe
2504	Unicorn-28362.exe
4840	Unicorn-50942.exe
604	Unicorn-55026.exe
1628	Unicorn-32367.exe
2208	Unicorn-18632.exe
4236	Unicorn-48804.exe
4972	Unicorn-59665.exe
4568	Unicorn-26054.exe
216	Unicorn-2104.exe
1412	Unicorn-9717.exe
2100	Unicorn-42196.exe
1228	Unicorn-6209.exe
4848	Unicorn-51061.exe
3948	Unicorn-10293.exe
5044	Unicorn-26365.exe
1248	Unicorn-57356.exe
4492	Unicorn-40258.exe
2788	Unicorn-6017.exe
4628	Unicorn-61440.exe
4908	Unicorn-65424.exe
3264	Unicorn-14377.exe
440	Unicorn-51689.exe
4776	Unicorn-60049.exe
5048	Unicorn-39436.exe
4488	Unicorn-26630.exe
3244	Unicorn-4163.exe
4952	Unicorn-24611.exe
4148	Unicorn-59686.exe
2872	Unicorn-10485.exe
4208	Unicorn-25430.exe
1396	Unicorn-11153.exe
560	Unicorn-31482.exe
3356	Unicorn-25452.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2464	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	88
PID 5076 wrote to memory of 2464	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	88
PID 5076 wrote to memory of 2464	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	88
PID 2464 wrote to memory of 3064	2464	Unicorn-50096.exe	89
PID 2464 wrote to memory of 3064	2464	Unicorn-50096.exe	89
PID 2464 wrote to memory of 3064	2464	Unicorn-50096.exe	89
PID 5076 wrote to memory of 2424	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	90
PID 5076 wrote to memory of 2424	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	90
PID 5076 wrote to memory of 2424	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	90
PID 3064 wrote to memory of 2572	3064	Unicorn-22468.exe	91
PID 3064 wrote to memory of 2572	3064	Unicorn-22468.exe	91
PID 3064 wrote to memory of 2572	3064	Unicorn-22468.exe	91
PID 2464 wrote to memory of 2908	2464	Unicorn-50096.exe	92
PID 2464 wrote to memory of 2908	2464	Unicorn-50096.exe	92
PID 2464 wrote to memory of 2908	2464	Unicorn-50096.exe	92
PID 2424 wrote to memory of 2492	2424	Unicorn-41496.exe	93
PID 2424 wrote to memory of 2492	2424	Unicorn-41496.exe	93
PID 2424 wrote to memory of 2492	2424	Unicorn-41496.exe	93
PID 5076 wrote to memory of 4320	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	94
PID 5076 wrote to memory of 4320	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	94
PID 5076 wrote to memory of 4320	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	94
PID 2572 wrote to memory of 2600	2572	Unicorn-3007.exe	95
PID 2572 wrote to memory of 2600	2572	Unicorn-3007.exe	95
PID 2572 wrote to memory of 2600	2572	Unicorn-3007.exe	95
PID 3064 wrote to memory of 2524	3064	Unicorn-22468.exe	96
PID 3064 wrote to memory of 2524	3064	Unicorn-22468.exe	96
PID 3064 wrote to memory of 2524	3064	Unicorn-22468.exe	96
PID 2492 wrote to memory of 1572	2492	Unicorn-60376.exe	98
PID 2492 wrote to memory of 1572	2492	Unicorn-60376.exe	98
PID 2492 wrote to memory of 1572	2492	Unicorn-60376.exe	98
PID 2908 wrote to memory of 4092	2908	Unicorn-36426.exe	97
PID 2908 wrote to memory of 4092	2908	Unicorn-36426.exe	97
PID 2908 wrote to memory of 4092	2908	Unicorn-36426.exe	97
PID 2424 wrote to memory of 1960	2424	Unicorn-41496.exe	99
PID 2424 wrote to memory of 1960	2424	Unicorn-41496.exe	99
PID 2424 wrote to memory of 1960	2424	Unicorn-41496.exe	99
PID 2464 wrote to memory of 4524	2464	Unicorn-50096.exe	100
PID 2464 wrote to memory of 4524	2464	Unicorn-50096.exe	100
PID 2464 wrote to memory of 4524	2464	Unicorn-50096.exe	100
PID 4320 wrote to memory of 3464	4320	Unicorn-15351.exe	101
PID 4320 wrote to memory of 3464	4320	Unicorn-15351.exe	101
PID 4320 wrote to memory of 3464	4320	Unicorn-15351.exe	101
PID 5076 wrote to memory of 3092	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	102
PID 5076 wrote to memory of 3092	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	102
PID 5076 wrote to memory of 3092	5076	5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe	102
PID 2600 wrote to memory of 4632	2600	Unicorn-651.exe	103
PID 2600 wrote to memory of 4632	2600	Unicorn-651.exe	103
PID 2600 wrote to memory of 4632	2600	Unicorn-651.exe	103
PID 2572 wrote to memory of 4016	2572	Unicorn-3007.exe	104
PID 2572 wrote to memory of 4016	2572	Unicorn-3007.exe	104
PID 2572 wrote to memory of 4016	2572	Unicorn-3007.exe	104
PID 2524 wrote to memory of 3632	2524	Unicorn-50407.exe	105
PID 2524 wrote to memory of 3632	2524	Unicorn-50407.exe	105
PID 2524 wrote to memory of 3632	2524	Unicorn-50407.exe	105
PID 3064 wrote to memory of 4912	3064	Unicorn-22468.exe	106
PID 3064 wrote to memory of 4912	3064	Unicorn-22468.exe	106
PID 3064 wrote to memory of 4912	3064	Unicorn-22468.exe	106
PID 3464 wrote to memory of 2764	3464	Unicorn-41492.exe	107
PID 3464 wrote to memory of 2764	3464	Unicorn-41492.exe	107
PID 3464 wrote to memory of 2764	3464	Unicorn-41492.exe	107
PID 1572 wrote to memory of 4368	1572	Unicorn-19126.exe	108
PID 1572 wrote to memory of 4368	1572	Unicorn-19126.exe	108
PID 1572 wrote to memory of 4368	1572	Unicorn-19126.exe	108
PID 4092 wrote to memory of 4904	4092	Unicorn-19126.exe	109

C:\Users\Admin\AppData\Local\Temp\5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe
"C:\Users\Admin\AppData\Local\Temp\5ef4af0b9c6c9fb1852b9592d486c3ebbc538bebd8e898148519b052cca0839d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37922.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        9⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
        10⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        10⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        10⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        10⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        10⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        9⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        10⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
        10⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        10⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14651.exe
        9⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58757.exe
        9⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        9⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        9⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        9⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        10⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        10⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        9⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        9⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        9⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
        8⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17846.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
        9⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
        9⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        9⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36215.exe
        9⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22422.exe
        9⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        8⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4860.exe
        8⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        8⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55188.exe
        7⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10512 -s 464
        8⤵
        Program crash
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        7⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        9⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        9⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        9⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        9⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        8⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        8⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        8⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1092.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
        9⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exe
        9⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        9⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        9⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        8⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        8⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27481.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        7⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33672.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        8⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43074.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        7⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        7⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
        7⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        6⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32430.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        6⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        6⤵
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41788.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        8⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        9⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        9⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
        9⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
        9⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        8⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        8⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37569.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        7⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        8⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        7⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        6⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11797.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
        6⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        6⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        6⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
        7⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 488
        8⤵
        Program crash
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        7⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        7⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        6⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        7⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        6⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        7⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        6⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        6⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        5⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50004.exe
        5⤵
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        5⤵
        
        PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        9⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59769.exe
        9⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
        9⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        9⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe
        9⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
        8⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22323.exe
        8⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        8⤵
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        8⤵
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exe
        7⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        8⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        7⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35440.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        7⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20194.exe
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48966.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        6⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        6⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        8⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19477.exe
        7⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
        7⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15412.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        6⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30988.exe
        7⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        7⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24627.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        6⤵
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        5⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
        7⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58347.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        6⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        6⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        5⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51268.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        6⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        6⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        5⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        5⤵
        
        PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        7⤵
        
        PID:16832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21400.exe
        7⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        7⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
        7⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        6⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        6⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17850.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        6⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        5⤵
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        6⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
      4⤵
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        5⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        6⤵
        
        PID:16784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46036.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        
        PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
      4⤵
      PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
      4⤵
      PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
      4⤵
      PID:16488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24710.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14377.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59458.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        8⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        8⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe
        8⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        7⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40600.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22374.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        8⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43959.exe
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        7⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        7⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46260.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22588.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
        7⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
        6⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        6⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        6⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        7⤵
        
        PID:652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10910.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        7⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64532.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56115.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        5⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        5⤵
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
      4⤵
      Executes dropped EXE
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15647.exe
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
        8⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        7⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        7⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        7⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5987.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        6⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        6⤵
        
        PID:16980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
        7⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        5⤵
        
        PID:13072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        5⤵
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24611.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20766.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        7⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        5⤵
        
        PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38478.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        5⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        5⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
        5⤵
        
        PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      4⤵
      PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29091.exe
      4⤵
      PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
      4⤵
      PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61771.exe
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47806.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        6⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        8⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        8⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        6⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        6⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 80
        7⤵
        Program crash
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        5⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        5⤵
        
        PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60049.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        6⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        5⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
      4⤵
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        5⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        5⤵
        
        PID:11900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44325.exe
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
      4⤵
      PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33556.exe
      4⤵
      PID:12916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
      4⤵
      PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
      4⤵
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        5⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe
        6⤵
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        6⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        6⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        5⤵
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
      4⤵
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3163.exe
        6⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        6⤵
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41722.exe
        5⤵
        
        PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
      4⤵
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        5⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23268.exe
        5⤵
        
        PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
      4⤵
      PID:13400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      4⤵
      PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
      4⤵
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
        5⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30071.exe
        5⤵
        
        PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
      4⤵
      PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      4⤵
      PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
      4⤵
      PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
      4⤵
      PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
    3⤵
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
      4⤵
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
      4⤵
      PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      4⤵
      PID:16880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
    3⤵
    PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
    3⤵
    PID:10088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57160.exe
    3⤵
    PID:13216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
    3⤵
    PID:15700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60677.exe
    3⤵
    PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
    3⤵
    PID:6724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41496.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41496.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42058.exe
        9⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
        9⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        9⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18918.exe
        9⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        9⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        8⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        8⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        8⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        8⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        7⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        8⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        7⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        7⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        7⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61481.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59665.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        7⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34674.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45275.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        7⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        6⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62581.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15941.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exe
        6⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        8⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
        6⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        7⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        7⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        6⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        6⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        5⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        5⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        5⤵
        
        PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        5⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        7⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        6⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        6⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54274.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
        5⤵
        
        PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
      4⤵
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
      4⤵
      PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        5⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        5⤵
        
        PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21958.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7643.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
      4⤵
      PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
      4⤵
      PID:10784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
      4⤵
      PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 720
      4⤵
      Program crash
      PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26365.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
      4⤵
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
        6⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
      4⤵
      PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7388.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
      4⤵
      PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      4⤵
      PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
      4⤵
      PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
      4⤵
      PID:8216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
      4⤵
      PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
      4⤵
      PID:13012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
      4⤵
      PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      4⤵
      PID:11488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
    3⤵
    PID:7396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
    3⤵
    PID:9616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
    3⤵
    PID:12388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45678.exe
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
    3⤵
    PID:9040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26054.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        6⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        7⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        7⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        7⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        6⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        6⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8300.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        7⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64532.exe
        7⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
        7⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55798.exe
        5⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33304.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13132.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        6⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5031.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        7⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19644.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        6⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12649.exe
        6⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15457.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
      4⤵
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50190.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        6⤵
        
        PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48171.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
      4⤵
      PID:5436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 212
        5⤵
        Program crash
        
        PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
      4⤵
      PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      4⤵
      PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
      4⤵
      PID:16628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
      4⤵
      PID:11372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        6⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24627.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        5⤵
        
        PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
      4⤵
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        6⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        5⤵
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        5⤵
        
        PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
      4⤵
      PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30076.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6510.exe
      4⤵
      PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
      4⤵
      PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
      4⤵
      PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37540.exe
      4⤵
      PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exe
      4⤵
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13718.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        6⤵
        
        PID:16792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exe
        6⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54393.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        5⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
        5⤵
        
        PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5987.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
      4⤵
      PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
      4⤵
      PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
    3⤵
    PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
      4⤵
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
      4⤵
      PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
    3⤵
    PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
      4⤵
      PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
    3⤵
    PID:10504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
    3⤵
    PID:13772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
    3⤵
    PID:9456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
    3⤵
    PID:9028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        5⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        6⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        6⤵
        
        PID:17368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4008.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        5⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8492.exe
      4⤵
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        5⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        5⤵
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        5⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
      4⤵
      PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
      4⤵
      PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
      4⤵
      PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
      4⤵
      PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20541.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        5⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        5⤵
        
        PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
      4⤵
      PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
    3⤵
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
      4⤵
      PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
      4⤵
      PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
      4⤵
      PID:15796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
    3⤵
    PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
      4⤵
      PID:1848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
    3⤵
    PID:9660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
    3⤵
    PID:12828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44099.exe
    3⤵
    PID:3352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        5⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7531.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
      4⤵
      PID:12140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15570.exe
      4⤵
      PID:15392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
      4⤵
      PID:13260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
      4⤵
      PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
    3⤵
    PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
    3⤵
    PID:10080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
    3⤵
    PID:13236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
    3⤵
    PID:15660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
    3⤵
    PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
    3⤵
    PID:8792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
    3⤵
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28875.exe
        5⤵
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60677.exe
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
      4⤵
      PID:15124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
      4⤵
      PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65394.exe
      4⤵
      PID:17160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23780.exe
    3⤵
    PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
      4⤵
      PID:10820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      4⤵
      PID:16768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
    3⤵
    PID:8640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
    3⤵
    PID:11840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
    3⤵
    PID:15652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
  2⤵
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36848.exe
    3⤵
    PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
      4⤵
      PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
      4⤵
      PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
    3⤵
    PID:9076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
    3⤵
    PID:12820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
    3⤵
    PID:15972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
    3⤵
    PID:16932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
  2⤵
  PID:6944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37046.exe
  2⤵
  PID:7664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
  2⤵
  PID:12768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
  2⤵
  PID:16072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
  2⤵
  PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1236 -ip 1236
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5436 -ip 5436
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6092 -ip 6092
1⤵
PID:7320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10512 -ip 10512
1⤵
PID:12140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:8720

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe

Filesize
184KB

MD5
d08215158ea2e754e70bee24425df28b

SHA1
5e429f7b9ceed02bafd3d2fe42f85ab5adc15e62

SHA256
beacf80e714462f9a5dfb4bb768aa7370a54bc01a612aee733f571f07634e786

SHA512
d0b142a686e0b787b99da6f73e9378bdd0afb8181946a21ec8421b8fc6d5b17958f26252538259073a07a4e31fe0c81cbef4b11e807a69418049463d223aa62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe

Filesize
184KB

MD5
200316d7db93567dc0ece1fa8f1319a9

SHA1
3965c1ffa8ca62c6197818edf3c5a5cc35de9f08

SHA256
ba380d5f6df71ebdc6b9b0213c5255d5d1cd7239ae7b0b0c3ab626469a283670

SHA512
00fdf160c5335326ed2ac1953ea872693ef944a12aabeab32ea08790fe460313bac6fa8eb39f67947d46b3af68b765165d42cdc2640e5114a625e67477d14945

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe

Filesize
184KB

MD5
c7349c852e59e3744a645965d50e95b4

SHA1
03a15e99dc41d654b349785ec89e99c993afea30

SHA256
aefa3ca4bcd6ec54146c7f82f57a0d9137aeedf87e8fbf946540afa7a9f6709c

SHA512
ec1634948da34a7338eddc69de28374d2d6e9e7a8e12ab85bc8b8c069e1cbeb594937c50657b822a0dbf0183ecf0b5645a8ddebdc9c0edd65f3031d60602102d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe

Filesize
184KB

MD5
3c0e1605c3a344b36a8c25c166cb12e5

SHA1
aab3448c0c52bc9cc26477dadbc0e40930664c8e

SHA256
e06fdeb69e8dec73096ae934ac462dd28f8d574503efedc4c496115a3b9d30df

SHA512
801aa7e2c1e96eca94c6ff43de3dc48bb5fc7111409ebd41e8d09408fb0ccfd717f96b8a2da329b78b215739f9e6b5c813b215ec6210dde17a324ecc80d6d14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15647.exe

Filesize
184KB

MD5
5f5d29d575bd9ef7350c4fba96b1e708

SHA1
198aaea4d9f4ae583765684218750f405b2af0a4

SHA256
45b24a03313e6ca7505ccb6371bdd65690d59fa82b2ac6c78812f05496e55924

SHA512
60262672a5c5a7bee5e1c02b1a609324ee55622593e969e6951c6ade7a6a32aee42ef9c49abb78283932b9ed3de105aa576a7feadebdfeae827db12bdc6c613c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe

Filesize
184KB

MD5
6a2055c388606f2e75b1dfc46d17621c

SHA1
c7465d6c91937855218f7967f772dd901a16e333

SHA256
6836f9c449a7b2cc619e8fb4f5bdece9d56eb76cf26e3c0f4e727ead76983a72

SHA512
a7d9058e007c0bb45585f422e1352b9b3b1b91fca8f19a6736d6ccbd727e69acb69e7adcd074c322374f8a02cc4fdcc60ce2459e9b4ca0d09b146e6c6c0c680c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22468.exe

Filesize
184KB

MD5
14195316c9198bbf134aa8f0c2586fce

SHA1
93e05e1ad4572783170f256a5e1f5a73e113619a

SHA256
41496e8756bebd3aca209828de9878e206b4616f7030340c3f1e81c4b1d1dd9c

SHA512
f32396e56799698fafe260722e6d063fd5f1f2473b4ee3718be2c6ce45f4dde1ef820966f366402e8d58979c16de48e1e9e6d8c46449385a5cfa383beda9d391

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24710.exe

Filesize
184KB

MD5
9103647d86b1a5fe697115d0abb357c5

SHA1
bcf9889a846ca3ee56727ef68c2e9bb9467a13dd

SHA256
32f6527df5735befd351789fa106db1c449adf5570bff17d57c01f8ff4bb6eac

SHA512
117fe4d4d41850f97d29b53e8225162e2c7ed1212014fbc7578b1706211f25338a28fefba0c1e245ad683cb478410a9f5172052c68b7b1f1c28e75c8bdfc9de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe

Filesize
184KB

MD5
ea1e4bedc2d3817d81f77c565d14a689

SHA1
5e3501e580eb09fdde97b773bebffc6419469188

SHA256
60de50cf01e3e82e5f2c401594d72cda7f30dfa374615b4498d0a8a19fe5b9a1

SHA512
187a11e0aa260eef57b1fb821b315376acbc434e64cb26197be502bb2503af7f3f5a67a35d649b307f3aecbc8603c97112abe2c2eab15b2102f971295ba82ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe

Filesize
184KB

MD5
1c38c9e1b6868fe457c8a84c1327472d

SHA1
3254f62d45e57d6b29cfadf7505f27ed41f0494d

SHA256
92824a526dfe3ba71ff138325f53e89dd5a813511b5afaf6f19eba5168cc4565

SHA512
637d901617204fde0abe08a1c1bcf9bd4b5bb21f90a97a5c0369486f8f13b1a05642b5f9ab703a2dc4ed48b5f34533c55bfa560cd4d73a07be2d7259293f7946

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe

Filesize
184KB

MD5
7255f62f54106fcc548297a7d0dc050f

SHA1
5cf43e95fb293538c6b1e476d2a23e8a9be1db4b

SHA256
9c886349cde0c62375de0b70f3fa0f919812ab5a86d2f8a19194f4ac3083c38b

SHA512
0d0bd30d9b85f0f911baa6c872867f4616bc2b8ac2a747e7c80042fa17027849cc592c76c690872a5cdcb9d7e94620985aba7ed7dfdb8d1da01d3a660bc022b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe

Filesize
184KB

MD5
b852772061da06df321219b778e9a742

SHA1
09206b2f84dd43787811276a210db3a23acdd54a

SHA256
1b73885b6cf83c2858b0317c228c33a7bf3f142129de0365f88f70c789e96cad

SHA512
dfb8593e95772d9aa376bbe2288c46244fdaaf7223a37e65e971d08b8fc14e94e53a3c92e60e3f851f63224ce4ea506310d3a249142d1c979d9400fd90625300

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe

Filesize
184KB

MD5
f9af916323d2d9dca66273346e3803b0

SHA1
a24e337ebee693f055fa345c9c31bd387dc70375

SHA256
2ef11b7ab0d8c6c514ec16d716db20a0c10c540a27ceeb417d04ec53d8ad2796

SHA512
f6ac492a2085f12b42daf95eb1e58491e87ef9a5341316582c38b36a6aef591500b2977cfd6740f05ab291a7f0ad64c2e97070d9e1c6dc34139e0d0eaf686455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe

Filesize
184KB

MD5
3578639c20af52bcdeb8cc76a8a1a4f7

SHA1
058067ae108a2062bc814aba8417ad06fc3559b4

SHA256
3d79ca1d286834eaf1d519d776fac387ae912e527fe37c0cfdccbe92a1a74b33

SHA512
223ad7b6025a18c0421a4ffd15ac0091ed1820c16cbd55fa0657eca9fc6a91a82a561d6c39024333f37417340f818b2504491d8a650e8bc38fabe72d6d560cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe

Filesize
184KB

MD5
0052066c822c34464012b53254f3c5fb

SHA1
a9dc844d1643fc40954e00c88eb69a6f264a70d3

SHA256
198ca0a6c521199c5be7fe5d69a0903117528c9bedb2d49862d7b3be94ae409b

SHA512
0757befad01500e79cb4946701252285c55f23d69659e4d531bcd886d21c16a2ec67b1858d40a96f4efe184b9c5265cbb4cc23b6714cd2eae748290e4b136704

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe

Filesize
184KB

MD5
352e98ec900ff60f6eb3b769a0ed00a3

SHA1
e09b25feee46a78a082f7446fb7e68b6b89e162d

SHA256
be3e1c3db3773bdbc2bed6f3283a63f00f9c1422bb922ad8b4796150f2e4443b

SHA512
23a284d1eebd2c97f3d7c9a427e9489dd083c33687f92a90a32d53253a1d110a4e75dbbaa2824784c14f2e9d5e93c7d34121e1e7920e26ce9bf3bd65f34c10e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe

Filesize
184KB

MD5
6d4e5b43bbaf4bb2421bd883a78b128b

SHA1
77f8513e9d48b2d54f757f0b2bc9fb66806224c6

SHA256
5b90878b16af6ca88e1300eb65ad3bea1e27190f39c4d6794f37e979b9a31c8c

SHA512
bf61683c5c8a14c1886f8814d4664d4bb3bad82a9af3145c6d8e142c136edec8020f79836d6d1d502a95d54f7c6b1940edf4942bf1e4fb550142d69805502e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37922.exe

Filesize
184KB

MD5
668902b782685c7df234b89982062f11

SHA1
b1fa05f3d8f26b8446d9228ec10b911fdea14008

SHA256
cd1352e79e30de646f10196f5ccd0803459fa3d083fc7177626c67230853d666

SHA512
13ddc4a72369a5bf2565110a3a33a4cbb5b644acbb064e211113f095c684228d4f665eecd112b262a15bdbcbca63767237e70da782d47c23484413a9a22dfbc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe

Filesize
184KB

MD5
883683be089ad6eea9299133bc44769b

SHA1
2b73f2e191c73555a82cc095e5cd64e976707aad

SHA256
bd7ada3aa86480c68b86d8e0ca33cca1803a2e38f84155e7935e8d4f30ac231a

SHA512
e102e20993a099ecd80369444a14369ba1d1f5b6f7873d62c86cafd1b2b0443e7ab8615bf42a64b515a84f1ad46c17748a6c643a65139430b6fd07e3ca21035a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe

Filesize
184KB

MD5
d853b3f17fe2564b97344d9c5958bc64

SHA1
461b5a5c565bab4255fd99e9bfaec6627b5133fc

SHA256
1f35d1e4dcd57d3cc8df68e3036909d102018da923d86fa4be20dabd02200740

SHA512
b705f29d68c134833e94a26580fe0c6bd0d2259960e1b0af53a6cca36375bbd84ecd58804e5abfc46514e0466840becf3ff8624c61ac75760f4bbd91e4f3fa54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41496.exe

Filesize
184KB

MD5
f1d20478519a2717650ccadea6cc8469

SHA1
2f5dfaf4f07833f0534879b0313f6c3f0c6b199e

SHA256
39460e34e5e5e12e7a9e384e87d9a47dad87ddce35e61d7869ec21c510e2c375

SHA512
86cacfa266b47d5b5eba0d3d81b75b7f803f463891d255dcec9ae7f239753b83452324298a8fe22fff52ebc13e91df9701eb3a823b9e3417a02e311936e4103b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe

Filesize
184KB

MD5
c55e9465b479470e03b430b3c08ff982

SHA1
40c3ea41919968313175eb80d0e2cc30b6bf120c

SHA256
9edc6a890f5fcda01522bfa16ad63f07e062b079f2e8fbcc41e501a2b4390d55

SHA512
b883671dacf2fc5da37f2d1a1e3cf942372ac55cdac72a1b449d55f2a9ed34ec9b9c4bdc8ac2ccdeba79df3f359e1010ff0165c968111b50d6a4742521c0a408

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47806.exe

Filesize
184KB

MD5
183aaf6bf1b8692a4d4de28d37c90b96

SHA1
d71fd14b11cc4fff8ebb2520034b562aba82a844

SHA256
79ac40e2edaad416beb6fe8d125772cc03177d58bd97286e04ffa80943802474

SHA512
bc98ef881479e38d21ccf91a1d50c7a45d690f7920e0ce0b733f800aded612765e866a98ba89a8d2d590fd699a4e6236930d58cde3f2ad438a39653f43e7d750

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe

Filesize
184KB

MD5
7f44f7a3607a7099741907d46041a726

SHA1
258c3cff48520840b15e2924494f5a08737671d1

SHA256
c4f8da0e84000c616eb05b1eaec05725b95fbada5c5bcceac6f8a2b33fd0a4cc

SHA512
5a6cea0fe6396574332f53f590003ae88dd50ca87774c1a3d91b9a63551660cde96b31b1efe45347b9b367096964820fdecf5612035fa41823e0f0a778b28935

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe

Filesize
184KB

MD5
03197d862712a16394481b50045900e8

SHA1
7c24a55baeed980cef97f2b9ae0214ac550cd4c1

SHA256
85b18f6f62a475062a775d93f555ba929541227245a79fbee19f8c571dc79fcc

SHA512
8d8b20ab8662ccab647280c4c766c6edea6df3f137c2c04e47da591dd3b1eca61f83b7f6bbc2664d046c9a22fb9c505a045ca24415a486123f94ea833a181032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe

Filesize
184KB

MD5
25ae64e85062967508bdcacb31b56ecd

SHA1
ab2506c32075f4333ec495fd8ebbe26f352ab527

SHA256
5a0b27317a59be4590c7a24afe7ae3564b42470ed7cad491d5254230035a6726

SHA512
b99bdf2444b9972f397451ba9a1c15f054ab8f6fba28cb684bcdebb92b44115db23e9032634975701c3f8ce525c6749bc8b7bf3215c368ebb3973a27031f410f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50730.exe

Filesize
184KB

MD5
7dfd35e4ab662e1f0b75f422386dd5f8

SHA1
5d6252170cfa758df7a2f03e092c2645268b8c32

SHA256
8c111bd99e7af35e29834548b826480cc540cc0e897e605847a1173a1e592291

SHA512
a9956b5c20c8f4947af11596f81a4ccb80db770db41535c3b3264f4aa93035a8bc3ef7760e7193eee36d2e8c6df98a32363feccd18aefdd5dc31a62fd202419b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe

Filesize
184KB

MD5
18654fad5ce38cf562e2cc1a96572593

SHA1
f7b2f425e92b9584a47f33b590ab01ab626ce42b

SHA256
4f93600788e958878b2c8104324ee534b123e4a1a91f5c1814694165364d1168

SHA512
563dc066dbd57155583d047c0e487176b7791af4ff12d566c834c5cce1476ffb7d928e9a85bb87750c830486723ee9e93501f144f134d725f7d8fd4aa255cea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe

Filesize
184KB

MD5
9f7da260e903ddf4291ee7e40dff3e94

SHA1
0de9b60308470d2c8eceaaa5bff889822c5368bf

SHA256
b0740e352e9f844726c04044860a73d33f5576a96b464238e0ad10fea6489459

SHA512
04d9f7352cfabea0aa1d43be9c8eb90e3b8a7d132683f0f03611da74a76c67a521c08f9e7b2663f15d37c1f2eb216d096ffb711e947999bf8c62883e6782d32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe

Filesize
184KB

MD5
b87ce42904951a98265a01e097134dc0

SHA1
142edf48b757837f68451684b18dc11b365f658d

SHA256
a8df62b151c35a993d6b0dc77196dcf3b65ef363a9fd24ed6d742b20b2c995c0

SHA512
add88be5665dff865a334b859842c1ad1531637d0013ab69825cc7cd9d2dc661146223e970a29ad7eb2e2a12ff41f80a0081b28b2f54d3a7287e6d27d1d3ee75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe

Filesize
184KB

MD5
b201b7b05b3d4f09800bcdbc69a74233

SHA1
bec1b8fc800578e4364794a350d84b8cfa6084b5

SHA256
d3b10d74f5845b3bbcb6715e8c6cea97dea46cb79d6b329a7b317ad0831e0f78

SHA512
9206428d030c6049c7692fd431a00ce65c662bc453e8ddc775f346433d2735f08171b5a17b3b85c4fa1d8d681a6a94abed73338090e9c5a6924049b4aa816f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe

Filesize
184KB

MD5
f8a5df1e37781987c93bd1d17f0f6f29

SHA1
1ab6d46eb82bdcf5c5e3bc8c46e063983d9818a5

SHA256
91c4283fd26e5bc01164ff66825b2103d0445beca9725e2d5ff4a299a80087b6

SHA512
e1a284a1f9fb8352bca923c1754ba8dfe61bf592c80b54542832069a4c9ea25a9733c8d9fc0e644589a64431814cb93df60b729813efb083884620ffabff3c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61440.exe

Filesize
184KB

MD5
d77c56c4c2219a137c3e6b37fe2d3c86

SHA1
38a345f898c6feb4ad0b233b24a402dfff0f63be

SHA256
e10b71c5de5cc501b2659511d407108b131250dadad8db8f3e1ec0eb880b35ed

SHA512
3580840273dda1ce5e4a9e4a10911b6c836dfb143ed0c46f88971cd066331e12eb93070ff824762f68b889c719b59fe97d036cba9bb88d2652e1b8644782989b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe

Filesize
184KB

MD5
82270ce0ab06745a8c8782763a5dfc09

SHA1
6501ad57f40045fa1005cd9d3954a98c8057f32a

SHA256
d4c2804ae66a44fd8951513e8d752384006c50934718f8129a008a661c008960

SHA512
369ad9668143f7151d59630ca41a3244720b4e10ed29cd8f4a0d40b41b5bafd35e1d9154505c42d900028804c056afaf2391a74e2dda623c041aa930e0e9b07d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe

Filesize
184KB

MD5
a4722bfed8b741e598f969aeb0d8f9d9

SHA1
01b957fee58511b7f4153f2121869f72742e4bc5

SHA256
c547266d9a041f6656e8d527defb08bb15855a6d383f893d8936039560dbeb3b

SHA512
f7bd637991937d41cd4b4245c31967edb0842d426d7732254411b631357b599a5512d8969d2f42bfa08623d00a44ecc2874e9cf25df4e3887defc18e8e8e48e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe

Filesize
184KB

MD5
77e09d752773dc5c9bdafd16a246e7f2

SHA1
f84af398149ba6fd6d219480418b730bbd8553c7

SHA256
9498fbf2b10787ff05b641b6b96b4f0fe6ca328b56c2ac92a8dc1a8cbfedefdc

SHA512
469eaca4feb67df960ecd5ecbad627b6a72dc65a48e8dad55fc6edf813a22b87a58e3d9f187053691aca16294a2632d92e6e747237acf9a175e8ec4a57586b98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe

Filesize
184KB

MD5
536a2a7cf4c58317665c16e8d2b65018

SHA1
ce0b77315688d67d09b2895da739f51befa91582

SHA256
91ac3f6b45327685a90cff66cdb6fad0fbbdaca30b7e6d5a0043149aee00b67d

SHA512
a16568874e6633a809b2e48a6ede4e316927f4eab009d146b27b818cc1a11100384d0b8f077cc642dc2605b3cb751ee6c8f93039ce9575f3b15f6a7a60b45879

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe

Filesize
184KB

MD5
aa3482e4f70dd19441bdbbc8d05597b8

SHA1
ad170c28149f4c11dad7edade1f55131ebe27703

SHA256
47de8483a6adf0a88e429cd07074a449a216d48e11ef1bef6719164b8838df71

SHA512
83f5a6c1c3915cd2fe88ab86012435f08eb836e6f1cb857a25383c658080f7be4d35a500c598b9aeeaaf715df7cbcfa47c4adbd5be9668e8b4c1cfa47913b409

Download Submit
memory/1936-653-0x0000000002FA0000-0x000000000307B000-memory.dmp

Filesize
876KB

Download
memory/5636-2922-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads