efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924

Analysis

max time kernel
150s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe
Size

184KB
MD5

8e1ea7ea6bf2c6db7a6d25702529d552
SHA1

408da4236514aa9129ddbca6fc67fee5cb12ecaf
SHA256

efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924
SHA512

a5a06e229949506025d4aaada2a17184e9264c4732f0c272ad5c5bb36b9c1030cca19c76719bcffd6cfe3014b5f3c9d3410edaf47cf0993076fa9fa909c1a0ec
SSDEEP

3072:uxfA9kopoDAfd2NxWho8rUkR6vMqnviuz:uxNoFF2N98wkR6Eqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4884	Unicorn-63661.exe
2496	Unicorn-50989.exe
1788	Unicorn-31123.exe
4480	Unicorn-41804.exe
264	Unicorn-3001.exe
4236	Unicorn-9131.exe
3768	Unicorn-43619.exe
3564	Unicorn-45468.exe
64	Unicorn-46516.exe
2020	Unicorn-844.exe
636	Unicorn-33709.exe
4824	Unicorn-33709.exe
4344	Unicorn-38954.exe
4496	Unicorn-25218.exe
2144	Unicorn-44819.exe
3316	Unicorn-62108.exe
1232	Unicorn-30483.exe
4592	Unicorn-3452.exe
8	Unicorn-40794.exe
2220	Unicorn-63644.exe
2700	Unicorn-10338.exe
4976	Unicorn-35549.exe
2196	Unicorn-62227.exe
4348	Unicorn-16556.exe
3468	Unicorn-10425.exe
3336	Unicorn-5107.exe
4420	Unicorn-411.exe
3620	Unicorn-38237.exe
4732	Unicorn-28978.exe
4092	Unicorn-39914.exe
2160	Unicorn-58652.exe
4752	Unicorn-24754.exe
4336	Unicorn-61340.exe
2428	Unicorn-21769.exe
5108	Unicorn-32861.exe
2624	Unicorn-23602.exe
2180	Unicorn-12611.exe
2124	Unicorn-6348.exe
4604	Unicorn-22227.exe
4984	Unicorn-54781.exe
1700	Unicorn-54781.exe
3800	Unicorn-12850.exe
2016	Unicorn-48267.exe
3112	Unicorn-55933.exe
1816	Unicorn-3395.exe
4524	Unicorn-42285.exe
4840	Unicorn-36556.exe
1348	Unicorn-16690.exe
4312	Unicorn-33410.exe
4500	Unicorn-53276.exe
4380	Unicorn-47146.exe
2140	Unicorn-36172.exe
3320	Unicorn-49171.exe
5008	Unicorn-60106.exe
4648	Unicorn-3499.exe
4788	Unicorn-57588.exe
2672	Unicorn-46762.exe
4080	Unicorn-19452.exe
4456	Unicorn-10322.exe
4288	Unicorn-18269.exe
5040	Unicorn-47028.exe
5140	Unicorn-972.exe
5160	Unicorn-27706.exe
5192	Unicorn-11771.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4160	4420	WerFault.exe	123
3060	4312	WerFault.exe	146
1972	5008	WerFault.exe	151
14400	6808	WerFault.exe	287
10856	9816	Process not Found	1196
19616	9692	Process not Found	1186
20108	12380	Process not Found	1279
17616	5444	Process not Found	1109
20144	7768	Process not Found	1127

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18460	dwm.exe
Token: SeChangeNotifyPrivilege	18460	dwm.exe
Token: 33	18460	dwm.exe
Token: SeIncBasePriorityPrivilege	18460	dwm.exe
Token: SeCreateGlobalPrivilege	1652	dwm.exe
Token: SeChangeNotifyPrivilege	1652	dwm.exe
Token: 33	1652	dwm.exe
Token: SeIncBasePriorityPrivilege	1652	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe
4884	Unicorn-63661.exe
1788	Unicorn-31123.exe
2496	Unicorn-50989.exe
4480	Unicorn-41804.exe
4236	Unicorn-9131.exe
264	Unicorn-3001.exe
3768	Unicorn-43619.exe
3564	Unicorn-45468.exe
64	Unicorn-46516.exe
2020	Unicorn-844.exe
4496	Unicorn-25218.exe
4824	Unicorn-33709.exe
4344	Unicorn-38954.exe
636	Unicorn-33709.exe
2144	Unicorn-44819.exe
3316	Unicorn-62108.exe
1232	Unicorn-30483.exe
4592	Unicorn-3452.exe
8	Unicorn-40794.exe
2700	Unicorn-10338.exe
2220	Unicorn-63644.exe
4976	Unicorn-35549.exe
2196	Unicorn-62227.exe
4420	Unicorn-411.exe
4348	Unicorn-16556.exe
4732	Unicorn-28978.exe
3336	Unicorn-5107.exe
3620	Unicorn-38237.exe
3468	Unicorn-10425.exe
4092	Unicorn-39914.exe
2160	Unicorn-58652.exe
4752	Unicorn-24754.exe
4336	Unicorn-61340.exe
2428	Unicorn-21769.exe
5108	Unicorn-32861.exe
2624	Unicorn-23602.exe
2180	Unicorn-12611.exe
2124	Unicorn-6348.exe
4604	Unicorn-22227.exe
4984	Unicorn-54781.exe
1700	Unicorn-54781.exe
3800	Unicorn-12850.exe
2016	Unicorn-48267.exe
3112	Unicorn-55933.exe
1816	Unicorn-3395.exe
4524	Unicorn-42285.exe
1348	Unicorn-16690.exe
4840	Unicorn-36556.exe
4312	Unicorn-33410.exe
5008	Unicorn-60106.exe
4380	Unicorn-47146.exe
4500	Unicorn-53276.exe
2140	Unicorn-36172.exe
4648	Unicorn-3499.exe
4080	Unicorn-19452.exe
3320	Unicorn-49171.exe
4788	Unicorn-57588.exe
2672	Unicorn-46762.exe
4456	Unicorn-10322.exe
4288	Unicorn-18269.exe
5040	Unicorn-47028.exe
5140	Unicorn-972.exe
5192	Unicorn-11771.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4884	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	87
PID 4756 wrote to memory of 4884	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	87
PID 4756 wrote to memory of 4884	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	87
PID 4884 wrote to memory of 2496	4884	Unicorn-63661.exe	95
PID 4884 wrote to memory of 2496	4884	Unicorn-63661.exe	95
PID 4884 wrote to memory of 2496	4884	Unicorn-63661.exe	95
PID 4756 wrote to memory of 1788	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	96
PID 4756 wrote to memory of 1788	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	96
PID 4756 wrote to memory of 1788	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	96
PID 1788 wrote to memory of 4480	1788	Unicorn-31123.exe	98
PID 1788 wrote to memory of 4480	1788	Unicorn-31123.exe	98
PID 1788 wrote to memory of 4480	1788	Unicorn-31123.exe	98
PID 4756 wrote to memory of 264	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	99
PID 4756 wrote to memory of 264	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	99
PID 4756 wrote to memory of 264	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	99
PID 2496 wrote to memory of 4236	2496	Unicorn-50989.exe	100
PID 2496 wrote to memory of 4236	2496	Unicorn-50989.exe	100
PID 2496 wrote to memory of 4236	2496	Unicorn-50989.exe	100
PID 4884 wrote to memory of 3768	4884	Unicorn-63661.exe	101
PID 4884 wrote to memory of 3768	4884	Unicorn-63661.exe	101
PID 4884 wrote to memory of 3768	4884	Unicorn-63661.exe	101
PID 4236 wrote to memory of 3564	4236	Unicorn-9131.exe	104
PID 4236 wrote to memory of 3564	4236	Unicorn-9131.exe	104
PID 4236 wrote to memory of 3564	4236	Unicorn-9131.exe	104
PID 2496 wrote to memory of 64	2496	Unicorn-50989.exe	105
PID 2496 wrote to memory of 64	2496	Unicorn-50989.exe	105
PID 2496 wrote to memory of 64	2496	Unicorn-50989.exe	105
PID 264 wrote to memory of 2020	264	Unicorn-3001.exe	106
PID 264 wrote to memory of 2020	264	Unicorn-3001.exe	106
PID 264 wrote to memory of 2020	264	Unicorn-3001.exe	106
PID 3768 wrote to memory of 636	3768	Unicorn-43619.exe	107
PID 3768 wrote to memory of 636	3768	Unicorn-43619.exe	107
PID 4480 wrote to memory of 4824	4480	Unicorn-41804.exe	108
PID 3768 wrote to memory of 636	3768	Unicorn-43619.exe	107
PID 4480 wrote to memory of 4824	4480	Unicorn-41804.exe	108
PID 4480 wrote to memory of 4824	4480	Unicorn-41804.exe	108
PID 1788 wrote to memory of 4496	1788	Unicorn-31123.exe	110
PID 1788 wrote to memory of 4496	1788	Unicorn-31123.exe	110
PID 1788 wrote to memory of 4496	1788	Unicorn-31123.exe	110
PID 4884 wrote to memory of 4344	4884	Unicorn-63661.exe	109
PID 4884 wrote to memory of 4344	4884	Unicorn-63661.exe	109
PID 4884 wrote to memory of 4344	4884	Unicorn-63661.exe	109
PID 4756 wrote to memory of 2144	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	111
PID 4756 wrote to memory of 2144	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	111
PID 4756 wrote to memory of 2144	4756	efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe	111
PID 3564 wrote to memory of 3316	3564	Unicorn-45468.exe	112
PID 3564 wrote to memory of 3316	3564	Unicorn-45468.exe	112
PID 3564 wrote to memory of 3316	3564	Unicorn-45468.exe	112
PID 4236 wrote to memory of 1232	4236	Unicorn-9131.exe	113
PID 4236 wrote to memory of 1232	4236	Unicorn-9131.exe	113
PID 4236 wrote to memory of 1232	4236	Unicorn-9131.exe	113
PID 64 wrote to memory of 4592	64	Unicorn-46516.exe	114
PID 64 wrote to memory of 4592	64	Unicorn-46516.exe	114
PID 64 wrote to memory of 4592	64	Unicorn-46516.exe	114
PID 2496 wrote to memory of 8	2496	Unicorn-50989.exe	115
PID 2496 wrote to memory of 8	2496	Unicorn-50989.exe	115
PID 2496 wrote to memory of 8	2496	Unicorn-50989.exe	115
PID 2020 wrote to memory of 2220	2020	Unicorn-844.exe	116
PID 2020 wrote to memory of 2220	2020	Unicorn-844.exe	116
PID 2020 wrote to memory of 2220	2020	Unicorn-844.exe	116
PID 264 wrote to memory of 2700	264	Unicorn-3001.exe	117
PID 264 wrote to memory of 2700	264	Unicorn-3001.exe	117
PID 264 wrote to memory of 2700	264	Unicorn-3001.exe	117
PID 4496 wrote to memory of 4976	4496	Unicorn-25218.exe	118

C:\Users\Admin\AppData\Local\Temp\efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe
"C:\Users\Admin\AppData\Local\Temp\efbd04e313b14abcc1cca181abfafb9c2e2cd6569907a9589e7dbe814cc6b924.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9131.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14428.exe
        9⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        10⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        11⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        11⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        11⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        11⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        10⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        10⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        10⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        10⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        9⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        9⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        9⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        9⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        9⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        10⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        10⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        10⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        9⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        9⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        9⤵
        
        PID:19420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        8⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
        8⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        8⤵
        
        PID:18948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14203.exe
        9⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        10⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        10⤵
        
        PID:17488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        10⤵
        
        PID:19348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        9⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        9⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        9⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        8⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        8⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        8⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        7⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        9⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        8⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38191.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        7⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        7⤵
        
        PID:19440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        9⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        10⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        10⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        10⤵
        
        PID:18448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        10⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        9⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57787.exe
        9⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        9⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        9⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        8⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        8⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        8⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        8⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        8⤵
        
        PID:18572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18569.exe
        7⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        6⤵
        Executes dropped EXE
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63868.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        9⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        9⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        9⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        9⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        8⤵
        
        PID:17460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11261.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
        7⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        7⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
        6⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        6⤵
        
        PID:18892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30483.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        9⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        10⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        10⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        10⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        9⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        9⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15685.exe
        9⤵
        
        PID:18372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        9⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
        8⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55032.exe
        8⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        9⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        9⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        9⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        8⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33299.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        7⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        8⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2615.exe
        8⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2106.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
        7⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        7⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        7⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        6⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-588.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        9⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        9⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        9⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        8⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        7⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
        7⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        8⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        8⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        7⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        7⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        7⤵
        
        PID:19412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51606.exe
        6⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1703.exe
        6⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        6⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7883.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        5⤵
        
        PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1787.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13020.exe
        9⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        10⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exe
        10⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
        10⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        9⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        9⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
        9⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1811.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exe
        8⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
        9⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        8⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13909.exe
        7⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        8⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6808 -s 636
        8⤵
        Program crash
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        7⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        7⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13020.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        7⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        6⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        8⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        8⤵
        
        PID:18868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        7⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exe
        7⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        7⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        7⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        6⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        7⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        6⤵
        
        PID:18956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        5⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        9⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        9⤵
        
        PID:18772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        9⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        8⤵
        
        PID:18784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        7⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        7⤵
        
        PID:18888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        7⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11586.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        6⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50220.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        7⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        7⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        7⤵
        
        PID:18752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51606.exe
        6⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        6⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        6⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
        5⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31186.exe
        5⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        5⤵
        
        PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
        6⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37811.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe
        6⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exe
        7⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        7⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        6⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        5⤵
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        5⤵
        
        PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9052.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18018.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        6⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        6⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        5⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        5⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
        5⤵
        
        PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
      4⤵
      PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13020.exe
        5⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        5⤵
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
      4⤵
      PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
      4⤵
      PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 632
        6⤵
        Program crash
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 488
        6⤵
        Program crash
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        6⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exe
        7⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        7⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        6⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        5⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        6⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        5⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        6⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        8⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        8⤵
        
        PID:18296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        8⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48016.exe
        6⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        6⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        7⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        7⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        6⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        6⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        5⤵
        
        PID:18500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        7⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        7⤵
        
        PID:18812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        7⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        6⤵
        
        PID:18972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        5⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-544.exe
        5⤵
        
        PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        5⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        5⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        5⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        5⤵
        
        PID:17284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
      4⤵
      PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58157.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        5⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        5⤵
        
        PID:19196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      4⤵
      PID:15408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16556.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        8⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        8⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        7⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        7⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        7⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        6⤵
        
        PID:17436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29468.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
        5⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56022.exe
        5⤵
        
        PID:18308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        7⤵
        
        PID:17708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        6⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38595.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        6⤵
        
        PID:17680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        6⤵
        
        PID:19404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        5⤵
        
        PID:17496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        6⤵
        
        PID:19100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        5⤵
        
        PID:18212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57565.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63889.exe
        5⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41759.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
      4⤵
      PID:13776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
      4⤵
      PID:18320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        5⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        6⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        7⤵
        
        PID:19192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53802.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        6⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        5⤵
        
        PID:18740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        6⤵
        
        PID:16948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        5⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        5⤵
        
        PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
      4⤵
      PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
      4⤵
      PID:12088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
      4⤵
      PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      4⤵
      PID:752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 488
      4⤵
      Program crash
      PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
    3⤵
    PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
      4⤵
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        5⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        5⤵
        
        PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7258.exe
      4⤵
      PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
      4⤵
      PID:17476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
    3⤵
    PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
    3⤵
    PID:11396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
    3⤵
    PID:15440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
    3⤵
    PID:2012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        8⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        8⤵
        
        PID:18024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        8⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        7⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        7⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        7⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        6⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
        6⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        6⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        7⤵
        
        PID:17468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39418.exe
        5⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        5⤵
        
        PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        8⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        8⤵
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        8⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe
        7⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        7⤵
        
        PID:18084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        7⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16615.exe
        6⤵
        
        PID:18636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        6⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        7⤵
        
        PID:18712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-928.exe
        7⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        6⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        5⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4994.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        6⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        6⤵
        
        PID:18956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        5⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        5⤵
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48940.exe
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        5⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
        5⤵
        
        PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21962.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
      4⤵
      PID:15624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
      4⤵
      PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe
        8⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        8⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36803.exe
        7⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        7⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32263.exe
        7⤵
        
        PID:19124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        6⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
        6⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        7⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        6⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        6⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        6⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        6⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54987.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        7⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        6⤵
        
        PID:18068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
        5⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        5⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        6⤵
        
        PID:18000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        5⤵
        
        PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        5⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        5⤵
        
        PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14466.exe
      4⤵
      PID:13500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
      4⤵
      PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
      4⤵
      PID:19424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        7⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14343.exe
        7⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:17452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        6⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        5⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
        5⤵
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
        6⤵
        
        PID:18760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        6⤵
        
        PID:724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        5⤵
        
        PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
      4⤵
      PID:12044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
      4⤵
      PID:15928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        6⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
      4⤵
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
      4⤵
      PID:16312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-874.exe
      4⤵
      PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
      4⤵
      PID:16560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
      4⤵
      PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49282.exe
    3⤵
    PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
    3⤵
    PID:10736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
    3⤵
    PID:14688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54781.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        9⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        9⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        9⤵
        
        PID:17780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        9⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        8⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        8⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        7⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        7⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24311.exe
        7⤵
        
        PID:18824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        7⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
        6⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        6⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32995.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
        7⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        6⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        6⤵
        
        PID:18976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
        6⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        5⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        7⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        7⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42250.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        6⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        6⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
        6⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        6⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
        6⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        5⤵
        
        PID:18052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63668.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
        5⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26057.exe
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31954.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
      4⤵
      PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
      4⤵
      PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54781.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9564.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-743.exe
        7⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        7⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        6⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
        6⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        6⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        6⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10647.exe
        5⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        6⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        6⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        6⤵
        
        PID:19344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        5⤵
        
        PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        5⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        5⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        5⤵
        
        PID:18016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        5⤵
        
        PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      4⤵
      PID:13732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
      4⤵
      PID:17420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34786.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        5⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        5⤵
        
        PID:18332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        5⤵
        
        PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
      4⤵
      PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        5⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
      4⤵
      PID:13208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
      4⤵
      PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
      4⤵
      PID:6456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
    3⤵
    PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
      4⤵
      PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
      4⤵
      PID:11972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
      4⤵
      PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
      4⤵
      PID:7808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
    3⤵
    PID:8004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
    3⤵
    PID:12228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
    3⤵
    PID:16276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
    3⤵
    PID:19452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        6⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        6⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        6⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        
        PID:18360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        5⤵
        
        PID:17988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
        5⤵
        
        PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36346.exe
      4⤵
      PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
      4⤵
      PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
      4⤵
      PID:404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        5⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        5⤵
        
        PID:18756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
      4⤵
      PID:15392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
      4⤵
      PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
    3⤵
    PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34349.exe
      4⤵
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe
        5⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7586.exe
      4⤵
      PID:15324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44104.exe
      4⤵
      PID:18880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
      4⤵
      PID:18700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
    3⤵
    PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
    3⤵
    PID:11424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exe
    3⤵
    PID:15424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
    3⤵
    PID:9032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7931.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54524.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        6⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34113.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
      4⤵
      PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        5⤵
        
        PID:16940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        5⤵
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
      4⤵
      PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
      4⤵
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
    3⤵
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
      4⤵
      PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37864.exe
        5⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        5⤵
        
        PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
      4⤵
      PID:15288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
      4⤵
      PID:16052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
      4⤵
      PID:17312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
    3⤵
    PID:8552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
    3⤵
    PID:11944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
    3⤵
    PID:15896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
    3⤵
    PID:6664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
    3⤵
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
      4⤵
      PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        5⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        5⤵
        
        PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
      4⤵
      PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
      4⤵
      PID:17484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
      4⤵
      PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
    3⤵
    PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
    3⤵
    PID:11472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
    3⤵
    PID:15384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
    3⤵
    PID:2932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
  2⤵
  PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
    3⤵
    PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
      4⤵
      PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
      4⤵
      PID:17772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
      4⤵
      PID:1892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
    3⤵
    PID:10420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
    3⤵
    PID:14500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
    3⤵
    PID:17428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
    3⤵
    PID:6604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
  2⤵
  PID:7716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
    3⤵
    PID:16168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
  2⤵
  PID:11444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41554.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41554.exe
  2⤵
  PID:15460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
  2⤵
  PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4420 -ip 4420
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4312 -ip 4312
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5008 -ip 5008
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6808 -ip 6808
1⤵
PID:13528

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18460

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe

Filesize
184KB

MD5
8e892d1db6315aeb8ba470c28cdb34bd

SHA1
e8efcb423bb595a4c9abbb36cc889a3cb083b959

SHA256
94b7db9a0e1d210a08f6770ab4936c8b6dd5f921931b456263015e6f2ab5c90f

SHA512
4f459802d6f656f280eb391890c1b6d407f769b8ed63dfbed2af9db55083581bd9ef4d4bb3e6ef68b07d68273ae131402799325f85d78b3a6ed6c7c9548a72b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe

Filesize
184KB

MD5
baf0cfad16fb1dfcce7043b83be7a039

SHA1
efa1a179c9e6cc024453bbec89b4f1da5c6f854c

SHA256
b7580e0687f35f5e57b4d493a1e1a16a312c55012712d0ae8a11b19b67c192f7

SHA512
07a435c7ecf71f0682618653480b26d5989d17392392afb98a5718d6aab28347161e69e2df85eb2f40b1c2c0cd0cba511b8f8dfc90683e1aeddd3dd168c0f394

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe

Filesize
184KB

MD5
939130249f9539528a677079de6de9ae

SHA1
57bb1553977307b933b7fc34c7c68ddcfbcc29d2

SHA256
d1dbcf0963612960fcc7886f75cd9f7249cf2d089dabd31c78919b9b1fe6cf14

SHA512
b099c93ab08bc5805d393a37248381904cb5a5204ebe935e0e15ce41c7303438db7681ba4b28ff49ecf68e7ec3eaca8f96680aede4a48db268b62780bb5784c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16556.exe

Filesize
184KB

MD5
80dd5010b8cbedfe6ba3b29bc39afc84

SHA1
d979ad2bff35333fcec91ba034bbc1db71d36431

SHA256
291d27f3907c1ff93c68eaae5787c02bf56566df4d9382f5399b6cc7196c8ba2

SHA512
6b7f5723dc5833993198d713b6296199d52e6e2f6aa23a63d08f21e800f5268cf70634f814b0afad21d493d53cee5a886db5bf8d214578e5730cfa414edaf2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe

Filesize
184KB

MD5
9b7ee14ee2e091929b19e4343433e8ba

SHA1
9e9249edad52ca27573cc0a6684741247a340fe7

SHA256
c1e3d07d80dd8d63f48fa734df1551faaef486a2aab285351ae1797352e75078

SHA512
cff8ccc99ea4222a0599603dcdff2d9beb3577b832db17586adcf701932080d8dc9c9cf03127ab377261a9bb272b586f9fd7ce977ca43db13ff6498b7dca61b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe

Filesize
184KB

MD5
68a5e0cb55d9e872840bb860bbcb5c48

SHA1
05e04ebc15c60eec02e50ef7e2fc2d4a2482bda4

SHA256
bf9011ebd7b229fa9e4b64fb6d170d21d72a660e6d93b0963a84b846d98bd98a

SHA512
12ccf06e5c382934b47ab68c2c0e27f360a78c0f19c5f11180760c01fcf5239d4a25e52878d651eca773a7525a7859d078b016d75cb3b9dab47f9414b96a412e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe

Filesize
184KB

MD5
4de8643aaf1034e0410a1f2c7a693abe

SHA1
0fec82b243a85abdfe5d6bf211d83677d48166a4

SHA256
5cf1c7d78cbd22c49f55d5b908aa6178328bbe4ffade73fdb9181f482e0783a0

SHA512
5cc645a71be61226c0745b436a9463a8e428bbe83e65f2edfecc925cc975b5c323342cf2709aae2127895b079260b16ddd4608b288d02677a77e005e2c563508

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe

Filesize
184KB

MD5
d427b9c6b9a6c542a2c33aa7da71c742

SHA1
d3398c7b81400833f7cf79aff97f7ff25577b267

SHA256
59eacfdf3b8204cad143496d0163aca85d51390d026c9d39b77d8ff8e5835833

SHA512
045346901ba72e3355db2dd37a752670f62d9fcab522f539a02907057421448fb4f15e0941ad30b4cbb30934fcc3e727951051955517d88e9fad13f4364552e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe

Filesize
184KB

MD5
7af6ee1c771171259a0e8c927ec17a66

SHA1
9033ea0943cd59730d7366ff77b5b99ded710c00

SHA256
9c9eb6a582b3fa3d899bf4f35cede125a00723449df8e0b452a23a0130401e50

SHA512
b127a116ac0e6a500d10ce170e8729aa19bb830d43607eb35010152007b79f44cb472e24a66f176cc92da8d2fada71266ae86656e0299f423cb7677ced6d251d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30483.exe

Filesize
184KB

MD5
2fede968bd660fa1c02784b8008c7aa1

SHA1
e12bd3e9a04dd62f2e9b57922b26066eb86b9e69

SHA256
6b1291fade796b11403af6871f1fffdcca6b8d2f37f25d59374352ad58c4fb7f

SHA512
0eaf7bc4f4bcf813360de757985713d23a01e6ddc9b9c0316d6b808d2cc3128a6d43943dc6d62066550dc75cc73bf358de49b7bcaeb694325c20f6d7eeec9c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe

Filesize
184KB

MD5
3019ff91db5ac347432f2b30ef175c23

SHA1
2f03557ad760b89c5a21ef3df2e7875247e2033d

SHA256
7a7b12b068956014c9e94ff2fef87c42c5e62ce50e8224c359c034e6f731864a

SHA512
48de1d0fca0faee1394bf3aee3dee081864730f77c59abcc5ee2e7b55c8f8d5c93707fc4d282a07c615c206c155f9c27999c8a4f0824543194bc5a446f268526

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe

Filesize
184KB

MD5
cd3f145899829f0f01f4b048d7e2fc44

SHA1
cd105e2b406906883b9128a010a3c9e6d423cbcc

SHA256
8697dd717190322e04b46e45da360e9ae6734324e909ca1139640fbda696f4e0

SHA512
5e1dd08bd62ab0faca1b27cd50671c2a557561a2a30243b805a08acef6e1f872636ab4669b5c7014036ef86f2fabcd276dd4df0d0bedd89a9c0e940e756e7c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe

Filesize
184KB

MD5
84dc91c648e208c48ce1ef7eb0972c0f

SHA1
add50df62c4b99bf772bdb50d2b372b8eb9d96a2

SHA256
ada7ed2e1e4930de409a883992df244ab9cc198b4e5b625599bbe21a63a931ff

SHA512
ce268697de2e0c1a6b11b3300c495277c46e7c970951f334e6848c5bfff4cd097551c3254e29245efe91eabb94e1defb220b79d45b028925852cb18ca2c1efb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe

Filesize
184KB

MD5
c6d2aa6680e285872a769df75b3cb15f

SHA1
ef0fb5933c313ee009b28e1703c7ddc34b2068fb

SHA256
1caa729a04fcd5dc767fbac211291c4e3ae3e8ba965cf5780e71db64ac60fba4

SHA512
62dba078f61d5cde8ee255a503c9693513f05c2683e5a98fe493460c3203217163599882e5ac7154818e7985e22262e50728bca5a04843b0d8f8c8295e4ff222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe

Filesize
184KB

MD5
708f4d887a9d7f031812ff242f16f63b

SHA1
d9bc38c73dff854585289b069e1fb551f77824da

SHA256
480c25294c383871c6b876334d0860cdc9c6a79c1cf6f5b31ed5e2cb13fb2692

SHA512
b24aafbcd5e97924b2e607555d6501f8c97269d6cd92d4de74f2f25a78b863062c01312bc4e9b8ed75ed4e12910fc49b353e747ecf2ddc78df6e1ca7b0770f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe

Filesize
184KB

MD5
5d53944fa393e10a3af46ca2c93fd1a4

SHA1
7f8a794b63791b6d986e16db60a316186c396da7

SHA256
5c199f881954c263139a474e7ec186bbc017d8008f4be4fa4c7ddd3bccc60bd5

SHA512
0e4358b0fb911dd97061efe2cd86b4aeeec97ff0dd5dc922b8004fa9047e50b832232b96a2e7501f3ed44c2e058a1d55a23bf0dcdbc28e50ad074c73d5aecab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe

Filesize
184KB

MD5
e32e00b14205fda5dcc7ef774de006eb

SHA1
8c86d3bb9b54b764f2be6824107802b0ed63654d

SHA256
0a417b66d2a9b361dc9d51214a760c3ce4dfbcbe5c8fee0553dfb1586f2cc834

SHA512
22e5973eedaf5fbfcfa7bc39f6d95d3298d111fd1de89a29f9c8e5341d19a728900050069fdb14b9438b4739aa92679fed91eab6b2f546edb9fd9fe209903ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe

Filesize
184KB

MD5
aeee51a78dfb3db121cbe45d5774676c

SHA1
91c8c8a22ae66e0cf83d574da4b9269834398583

SHA256
2ae4b3d2319a26916a5a00bb03c2f7280606676f917d547ce276f5a167d4c027

SHA512
28c0fce9315fffa1a00c79b88b46e88132000f4d5ff14d68623c345e3f49d79898343bb35fbc3df689ba6613451e70b7fea99d38cf0d2c2efd7cb3a4fe119fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe

Filesize
184KB

MD5
61100f5ac860a05227c2c0350acb59da

SHA1
9f5597f3678f64aefa9627c59f685dac1903a300

SHA256
e456ee13d91677639aa98743d3990ce0f200451a07199a299c0f96f94abb1fc6

SHA512
74a2941f0a620cb2d0c44879aed5f3b50e795a016fe4c8a7ca7b7cc4f90f5622ac01aed0cda8a654863e8d5e3261bc9959d9191bcd4267824ca93b0cadabaded

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe

Filesize
184KB

MD5
e0776f44ede62f02bcb30f581f965d59

SHA1
38ebc4b15ee9c3971407b3d541b5b248e819d197

SHA256
ec2ba8c1f6bbb4571a94cf55f6d56ae097ed1c6d476583755e60c0bc67224523

SHA512
2a308c7745c87a30abaa17cfd01e7644680ad0d6d14f836b167b3b3638c794bd8c45db23bc26c7cbd76160bf30d4e417ffbbb137ae30b87391a0444d0733aa00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe

Filesize
184KB

MD5
04369c5dd54c5dd55b92de23e89e51e0

SHA1
8730ee4b0f8b8a90b2332b42a47a7c202ce1c8d3

SHA256
460f8971b66ce5bcf445a7403f0d033d119994cc4c5b1109b20bfde57ff0e0ff

SHA512
d9b1e9b0f099b5523d84ff8432ca215acf0162317a48359628042f7d5099bb52c134cc889c06ac28cf89703d2aae9c0c7449a6578eff4bf43a81f02372b4822c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe

Filesize
184KB

MD5
48f9da2e45afcd4efb9b4a5c42d857df

SHA1
f5f3efd5bd0f270cb98186c89af92314f6a17f9c

SHA256
5cb2a12ddc8c496950bc79fff348f435fbfba01d020eb7afcb905e37baab7444

SHA512
f76388ad0f7aa3fd30ce9306cc4c47830610c7dd5b4b87a3a2cc06ded5ec5bfd3c1ef8326b6299c458834d2af1d77bfb523ef06e11df3d03f189008cc1d919fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe

Filesize
184KB

MD5
ff0207eee487745a8976f0bdb9462159

SHA1
f8523f716f1af7a3e9283604b177dfcdef45a9cb

SHA256
22a35cf53c7dbadac7b43b0bb78b81cdf2099765dd373716ef91e5e8497dbb85

SHA512
4e81c0bf076ad87adc1aaea088b07b413273220ca67b6c30d708bab6320fee7813a1f99610aa8d07f0ccaa1b599dd24c4f19e988698d44be6475c479e0f49a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe

Filesize
184KB

MD5
43d823d4674838da9105546890bc5744

SHA1
f197502cea264ce2fa7a12742a447a4bc4a7de7e

SHA256
65901c2e24849176442814f5fe6abfd689c2b89bc51002a9b3adb9de20ca572d

SHA512
9d7edcb4288316ad5839d944426e2bc118bca6f6af92e64573912f5b53345b46b699027906d0f7357e907a20039ef4ef0abd4bcd2cb236f2873c88c5be8e68b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe

Filesize
184KB

MD5
515a9e93941cd19b433caf817bd2a4c9

SHA1
35c87e54ff98fac4fb19e9a1e1a58c35a42d4014

SHA256
8b4d32c36a94a7cd8b72a41543341b134160e4fdd1c6e41ff6484810c95b2305

SHA512
4159a1b7850e2faa2d175dee9e3ab810d5a00118b254d946a66b973dae70557badcf4265e15e0523ed833a72a44285ea8fd5af6c2c7c9a4408f1ddad50f0da89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe

Filesize
184KB

MD5
16c776694e59f4432d6ca444722cb7f5

SHA1
05c18aebef92b8f30dbd0b45dab7add4fa70d2c6

SHA256
200a6d9ea33c97c07edda7fe481a0574a97932fd1e6c2a6d0a249824917d737a

SHA512
e98ae596eee6b827af29fedebecee89741f0937e60dde15f6ef8c68a3ce90c6dcaa6d9391695ae4e08a61ca6a1dfec37659fba5f3193f3d1f41aea8e86a6c205

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe

Filesize
184KB

MD5
e9278dc0f14b00541518ee5f8311bd41

SHA1
a36138049701edb2aaec0aa3cf1b8cb47ac7bfd2

SHA256
ae01efe6a98113d9d863bdb001bb74bb75a15a2a29091d0088f32d8430a223b1

SHA512
7e688c3ae4cad56f6ee5d8cdc618e4d1eedfdd69511c5a48e61f71a3e1e7dde1ed1fc018d46e54f9f430c116b9fb6ba51c3207894478065c7d01c7ba4d471007

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe

Filesize
184KB

MD5
0a5f2357d91138b3a3f1bef8bb0f01b4

SHA1
b40ff672a452ab7f6246236676cbe5832b89e5e0

SHA256
3c2060086b93990071e416664e00ba3923a1791561668adfd625b5ca15573818

SHA512
d1f8572144bf77f4bf98b01486af972c153e573b2d0caa6f5dd7cf6ff3e91f08440bf344629a2803daab0abc5b4ac36802641cdc35055cb9d8f6b559a33146f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe

Filesize
184KB

MD5
03fe48cbb60be843deeab99cf79b3a91

SHA1
654e9af88fc132e22a507d94fa217de4173e599e

SHA256
f68da6fecadedf66ff5b19221b3c9d7577ff4e160bfe243a66ae559ae08ca4c7

SHA512
81ad994c7a26895d3c02b809c8fc2d400da3095feb1c3996afa1fa9254c3f799bccc588b7201708f25b4c65400bde493f1805449e3055d32288bcd03ba17a33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe

Filesize
184KB

MD5
5e0b0de22866556a5894357516d93af7

SHA1
3237ba5218ceeb3a17835062a2d1c5b22ae5c04d

SHA256
78b7c06a956fcc31c0dc13b18f611513766a85bcb4cb9ffe0d19a10d5b497f37

SHA512
82b2f16d837e3dbfd9c70527603ce393543b76a7fd9102ff2e29ac590869b3f6931e0f8acd5bb2a54054a537cc1ab008b16e212539ed97d0daf8e45abcbeeab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe

Filesize
184KB

MD5
2130e296b17b01382dfd0d508e24ac3b

SHA1
45226edd593c9e08ca6dd6bd7e6fa171ef957c5c

SHA256
eacd8a4530b72d8772569c596500bd591499e867afc58ed9d38e8ff4379d26cf

SHA512
57b2228b95ef8f2bac435170514f8bfd870470b73bb8f7c9729719fbb032b62adca97dd064c52f337bc405fa389ab32654dfe40f2f5c1c8b784875aa81f06471

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe

Filesize
184KB

MD5
62dc21ad5525b596c8b20be314d57b02

SHA1
eb961b4e4aa3e1e7f4903084d57566dba1442345

SHA256
7ebb0ece29db89917522af62b05b1ee31b0f6daa27bc0e1f79bb09fe797ba037

SHA512
9024f8c2f72e66f5ab78243431b9f02134bcf06d0620427ce397daae9e58c5b44eeea41666ae115e6891a4466a690e3c17c12c4ccc3f9701062f3491cf12d595

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe

Filesize
184KB

MD5
7ab109ecd0a1e7c845547c1fa58746cd

SHA1
2e6c76727191040c8a56a5ae3d0b3d78e6f73350

SHA256
84140a10d2cad4844828830d7ae8e5a741af42abd58eeedd98630e668c55ac4b

SHA512
a26cbb32671e1307dba1fab0c796cd227b8672c41812fa9d7163157d4a104685a4e0e82aa60f81952262c2afd3cf5ea3774d968a1f97a7ecb4d16db13fd26c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9131.exe

Filesize
184KB

MD5
03e5dca82d3ac85a829911fb246c65ec

SHA1
4aa08708ae318b5873bbddf6827f84f43fce529a

SHA256
b7133db8b7db56e8eed7462d3b384263f3bb45b54659046c749d969dc7ad319b

SHA512
bb0c2265fefb4e2caf6c383807e33be58a77adff6b44243f118a4f386d25e06881e45edcfd81bf4d4959283612aae46cb6bf6ec5d33353fd17dffc4112f8dccd

Download Submit
memory/17520-2720-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/19672-3755-0x00007FF9B0100000-0x00007FF9B0159000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads