8f48cc6ac540a78a6f4bfe32e661b819132976b99889650509a0bb81a8d945d7

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
Size

468KB
MD5

b4390db86486933527aec96daa1a79e0
SHA1

9c6985f82b1526a86f03f06027bc3547387a02c6
SHA256

8f48cc6ac540a78a6f4bfe32e661b819132976b99889650509a0bb81a8d945d7
SHA512

1e5279d9ae440b2747559fb3245d2f54ad118e46f6005c7ca13f106b4535383a14437dd0d5c7c8823fc24affc1cef9e45b872bfd1a767519068182ff295abb2a
SSDEEP

3072:1bACogI8I05UtbYdPzcjbf8/EChChIpWsmHexVkEoDkLADu2yfl3:1b1oB8UtKP4jbfR0rRoDeKu2y

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2852	Unicorn-16472.exe
1564	Unicorn-15677.exe
3056	Unicorn-30390.exe
2672	Unicorn-9772.exe
2596	Unicorn-39107.exe
2436	Unicorn-58973.exe
2412	Unicorn-19786.exe
3048	Unicorn-13119.exe
2692	Unicorn-62158.exe
2732	Unicorn-11495.exe
2320	Unicorn-19856.exe
1808	Unicorn-19590.exe
312	Unicorn-31510.exe
2040	Unicorn-31510.exe
876	Unicorn-51376.exe
1476	Unicorn-59445.exe
1900	Unicorn-38278.exe
1560	Unicorn-30494.exe
2508	Unicorn-42206.exe
1676	Unicorn-40655.exe
2808	Unicorn-16151.exe
2236	Unicorn-7982.exe
2928	Unicorn-35101.exe
1220	Unicorn-41231.exe
3064	Unicorn-46062.exe
2136	Unicorn-390.exe
1528	Unicorn-41346.exe
1540	Unicorn-44146.exe
1620	Unicorn-54038.exe
904	Unicorn-55107.exe
2016	Unicorn-59387.exe
2324	Unicorn-65517.exe
2184	Unicorn-45652.exe
884	Unicorn-65517.exe
2360	Unicorn-65517.exe
1608	Unicorn-41013.exe
1260	Unicorn-57163.exe
2912	Unicorn-44770.exe
1816	Unicorn-24904.exe
2628	Unicorn-33264.exe
2624	Unicorn-10753.exe
2668	Unicorn-11329.exe
2572	Unicorn-5199.exe
2576	Unicorn-32304.exe
2580	Unicorn-961.exe
2748	Unicorn-46633.exe
2428	Unicorn-696.exe
2464	Unicorn-5922.exe
2076	Unicorn-45993.exe
2744	Unicorn-34018.exe
2700	Unicorn-39171.exe
1208	Unicorn-10945.exe
760	Unicorn-40057.exe
2228	Unicorn-46187.exe
1752	Unicorn-17961.exe
556	Unicorn-64561.exe
1756	Unicorn-17965.exe
1732	Unicorn-42928.exe
304	Unicorn-42928.exe
1612	Unicorn-39782.exe
3036	Unicorn-39782.exe
2940	Unicorn-43312.exe
2292	Unicorn-35144.exe
2828	Unicorn-23961.exe

Loads dropped DLL 64 IoCs

pid	Process
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2852	Unicorn-16472.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2852	Unicorn-16472.exe
3056	Unicorn-30390.exe
3056	Unicorn-30390.exe
2852	Unicorn-16472.exe
2852	Unicorn-16472.exe
1564	Unicorn-15677.exe
1564	Unicorn-15677.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2596	Unicorn-39107.exe
2596	Unicorn-39107.exe
2852	Unicorn-16472.exe
2852	Unicorn-16472.exe
2412	Unicorn-19786.exe
2412	Unicorn-19786.exe
2436	Unicorn-58973.exe
2436	Unicorn-58973.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
3056	Unicorn-30390.exe
3056	Unicorn-30390.exe
1564	Unicorn-15677.exe
1564	Unicorn-15677.exe
2672	Unicorn-9772.exe
2672	Unicorn-9772.exe
3048	Unicorn-13119.exe
3048	Unicorn-13119.exe
2596	Unicorn-39107.exe
2596	Unicorn-39107.exe
2692	Unicorn-62158.exe
2692	Unicorn-62158.exe
2852	Unicorn-16472.exe
2852	Unicorn-16472.exe
312	Unicorn-31510.exe
312	Unicorn-31510.exe
2732	Unicorn-11495.exe
2732	Unicorn-11495.exe
2040	Unicorn-31510.exe
2040	Unicorn-31510.exe
3056	Unicorn-30390.exe
3056	Unicorn-30390.exe
2320	Unicorn-19856.exe
2320	Unicorn-19856.exe
2412	Unicorn-19786.exe
876	Unicorn-51376.exe
2412	Unicorn-19786.exe
876	Unicorn-51376.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
1564	Unicorn-15677.exe
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
1564	Unicorn-15677.exe
2436	Unicorn-58973.exe
2436	Unicorn-58973.exe
2672	Unicorn-9772.exe
2672	Unicorn-9772.exe
1536	WerFault.exe
1536	WerFault.exe
1536	WerFault.exe
1536	WerFault.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1536	2928	WerFault.exe	50
2984	452	WerFault.exe	93
6608	6692	WerFault.exe	610
6572	6668	WerFault.exe	609

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
2852	Unicorn-16472.exe
3056	Unicorn-30390.exe
1564	Unicorn-15677.exe
2596	Unicorn-39107.exe
2672	Unicorn-9772.exe
2436	Unicorn-58973.exe
2412	Unicorn-19786.exe
3048	Unicorn-13119.exe
2692	Unicorn-62158.exe
2732	Unicorn-11495.exe
2040	Unicorn-31510.exe
2320	Unicorn-19856.exe
312	Unicorn-31510.exe
876	Unicorn-51376.exe
1808	Unicorn-19590.exe
1900	Unicorn-38278.exe
1476	Unicorn-59445.exe
1560	Unicorn-30494.exe
2508	Unicorn-42206.exe
1676	Unicorn-40655.exe
2236	Unicorn-7982.exe
2808	Unicorn-16151.exe
2928	Unicorn-35101.exe
1220	Unicorn-41231.exe
2136	Unicorn-390.exe
3064	Unicorn-46062.exe
1528	Unicorn-41346.exe
1540	Unicorn-44146.exe
1620	Unicorn-54038.exe
904	Unicorn-55107.exe
2016	Unicorn-59387.exe
2324	Unicorn-65517.exe
2184	Unicorn-45652.exe
884	Unicorn-65517.exe
2360	Unicorn-65517.exe
1608	Unicorn-41013.exe
1260	Unicorn-57163.exe
2912	Unicorn-44770.exe
1816	Unicorn-24904.exe
2628	Unicorn-33264.exe
2624	Unicorn-10753.exe
2668	Unicorn-11329.exe
2572	Unicorn-5199.exe
2464	Unicorn-5922.exe
2580	Unicorn-961.exe
2576	Unicorn-32304.exe
2748	Unicorn-46633.exe
2076	Unicorn-45993.exe
2428	Unicorn-696.exe
2744	Unicorn-34018.exe
2700	Unicorn-39171.exe
1208	Unicorn-10945.exe
2228	Unicorn-46187.exe
760	Unicorn-40057.exe
1752	Unicorn-17961.exe
556	Unicorn-64561.exe
1756	Unicorn-17965.exe
1732	Unicorn-42928.exe
304	Unicorn-42928.exe
2940	Unicorn-43312.exe
1612	Unicorn-39782.exe
3036	Unicorn-39782.exe
2828	Unicorn-23961.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2852	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	28
PID 2684 wrote to memory of 2852	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	28
PID 2684 wrote to memory of 2852	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	28
PID 2684 wrote to memory of 2852	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	28
PID 2684 wrote to memory of 1564	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 1564	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 1564	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 1564	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	29
PID 2852 wrote to memory of 3056	2852	Unicorn-16472.exe	30
PID 2852 wrote to memory of 3056	2852	Unicorn-16472.exe	30
PID 2852 wrote to memory of 3056	2852	Unicorn-16472.exe	30
PID 2852 wrote to memory of 3056	2852	Unicorn-16472.exe	30
PID 3056 wrote to memory of 2672	3056	Unicorn-30390.exe	31
PID 3056 wrote to memory of 2672	3056	Unicorn-30390.exe	31
PID 3056 wrote to memory of 2672	3056	Unicorn-30390.exe	31
PID 3056 wrote to memory of 2672	3056	Unicorn-30390.exe	31
PID 2852 wrote to memory of 2596	2852	Unicorn-16472.exe	32
PID 2852 wrote to memory of 2596	2852	Unicorn-16472.exe	32
PID 2852 wrote to memory of 2596	2852	Unicorn-16472.exe	32
PID 2852 wrote to memory of 2596	2852	Unicorn-16472.exe	32
PID 1564 wrote to memory of 2436	1564	Unicorn-15677.exe	33
PID 1564 wrote to memory of 2436	1564	Unicorn-15677.exe	33
PID 1564 wrote to memory of 2436	1564	Unicorn-15677.exe	33
PID 1564 wrote to memory of 2436	1564	Unicorn-15677.exe	33
PID 2684 wrote to memory of 2412	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	34
PID 2684 wrote to memory of 2412	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	34
PID 2684 wrote to memory of 2412	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	34
PID 2684 wrote to memory of 2412	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	34
PID 2596 wrote to memory of 3048	2596	Unicorn-39107.exe	35
PID 2596 wrote to memory of 3048	2596	Unicorn-39107.exe	35
PID 2596 wrote to memory of 3048	2596	Unicorn-39107.exe	35
PID 2596 wrote to memory of 3048	2596	Unicorn-39107.exe	35
PID 2852 wrote to memory of 2692	2852	Unicorn-16472.exe	36
PID 2852 wrote to memory of 2692	2852	Unicorn-16472.exe	36
PID 2852 wrote to memory of 2692	2852	Unicorn-16472.exe	36
PID 2852 wrote to memory of 2692	2852	Unicorn-16472.exe	36
PID 2412 wrote to memory of 2732	2412	Unicorn-19786.exe	37
PID 2412 wrote to memory of 2732	2412	Unicorn-19786.exe	37
PID 2412 wrote to memory of 2732	2412	Unicorn-19786.exe	37
PID 2412 wrote to memory of 2732	2412	Unicorn-19786.exe	37
PID 2436 wrote to memory of 2320	2436	Unicorn-58973.exe	38
PID 2436 wrote to memory of 2320	2436	Unicorn-58973.exe	38
PID 2436 wrote to memory of 2320	2436	Unicorn-58973.exe	38
PID 2436 wrote to memory of 2320	2436	Unicorn-58973.exe	38
PID 2684 wrote to memory of 1808	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	39
PID 2684 wrote to memory of 1808	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	39
PID 2684 wrote to memory of 1808	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	39
PID 2684 wrote to memory of 1808	2684	b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe	39
PID 3056 wrote to memory of 312	3056	Unicorn-30390.exe	40
PID 3056 wrote to memory of 312	3056	Unicorn-30390.exe	40
PID 3056 wrote to memory of 312	3056	Unicorn-30390.exe	40
PID 3056 wrote to memory of 312	3056	Unicorn-30390.exe	40
PID 1564 wrote to memory of 2040	1564	Unicorn-15677.exe	41
PID 1564 wrote to memory of 2040	1564	Unicorn-15677.exe	41
PID 1564 wrote to memory of 2040	1564	Unicorn-15677.exe	41
PID 1564 wrote to memory of 2040	1564	Unicorn-15677.exe	41
PID 2672 wrote to memory of 876	2672	Unicorn-9772.exe	42
PID 2672 wrote to memory of 876	2672	Unicorn-9772.exe	42
PID 2672 wrote to memory of 876	2672	Unicorn-9772.exe	42
PID 2672 wrote to memory of 876	2672	Unicorn-9772.exe	42
PID 3048 wrote to memory of 1900	3048	Unicorn-13119.exe	43
PID 3048 wrote to memory of 1900	3048	Unicorn-13119.exe	43
PID 3048 wrote to memory of 1900	3048	Unicorn-13119.exe	43
PID 3048 wrote to memory of 1900	3048	Unicorn-13119.exe	43

C:\Users\Admin\AppData\Local\Temp\b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b4390db86486933527aec96daa1a79e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16472.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-390.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41577.exe
        9⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        9⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
        9⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        9⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        9⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        9⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        9⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        7⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        8⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        8⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        7⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        8⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        7⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53090.exe
        6⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
        7⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe
        6⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        6⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        7⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        6⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36374.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        7⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17246.exe
        6⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24404.exe
        5⤵
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        7⤵
        
        PID:452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 200
        8⤵
        Program crash
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        7⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        7⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
        6⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        7⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59893.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16954.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59247.exe
        6⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        6⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        7⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        6⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        5⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        5⤵
        
        PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35101.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 200
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
      4⤵
      PID:8356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        8⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        8⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        7⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        6⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27078.exe
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        7⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55225.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        6⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        6⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        6⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe
        7⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        7⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        6⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        5⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        6⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        6⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
        6⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        6⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        5⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        5⤵
        
        PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        7⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10994.exe
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        6⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        6⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6654.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        6⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        5⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        5⤵
        
        PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
        6⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        5⤵
        
        PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
      4⤵
      PID:8444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42928.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        7⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        7⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        6⤵
        
        PID:308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        6⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        6⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        6⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        7⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        6⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        5⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15936.exe
        6⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        6⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
        5⤵
        
        PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        5⤵
        
        PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      4⤵
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe
      4⤵
      PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
      4⤵
      PID:8372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
        6⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
        6⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36142.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        5⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        5⤵
        
        PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
        5⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28155.exe
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        5⤵
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47870.exe
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
      4⤵
      PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      4⤵
      PID:8612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe
      4⤵
      Executes dropped EXE
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        5⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        5⤵
        
        PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36142.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55205.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41040.exe
        5⤵
        
        PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62215.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
      4⤵
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      4⤵
      PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
    3⤵
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
      4⤵
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
      4⤵
      PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
      4⤵
      PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      4⤵
      PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
    3⤵
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
    3⤵
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
    3⤵
    PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
    3⤵
    PID:7588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
    3⤵
    PID:8200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        7⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe
        8⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        7⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        7⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61848.exe
        6⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
        7⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exe
        6⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52268.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        7⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55225.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        6⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 188
        7⤵
        Program crash
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        6⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        5⤵
        
        PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29848.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
        7⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        6⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43393.exe
        6⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        7⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        5⤵
        
        PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        5⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
        5⤵
        
        PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
      4⤵
      PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51138.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
      4⤵
      PID:8724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48390.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36821.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        7⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11996.exe
        5⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe
        6⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13136.exe
        6⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18130.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        5⤵
        
        PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
        6⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10994.exe
        5⤵
        
        PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
      4⤵
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
      4⤵
      PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
      4⤵
      PID:8816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
      4⤵
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62215.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23242.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exe
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13861.exe
        5⤵
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21597.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      4⤵
      PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
      4⤵
      PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      4⤵
      PID:8760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
      4⤵
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12946.exe
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        5⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
        5⤵
        
        PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
      4⤵
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10033.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
      4⤵
      PID:6692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6692 -s 188
        5⤵
        Program crash
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      4⤵
      PID:8856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
    3⤵
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
      4⤵
      PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21686.exe
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
    3⤵
    PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
    3⤵
    PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
    3⤵
    PID:8020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
    3⤵
    PID:8752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11495.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        5⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
        6⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        6⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
        6⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        5⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        5⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        5⤵
        
        PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        5⤵
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52551.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5659.exe
        5⤵
        
        PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        5⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        5⤵
        
        PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      4⤵
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      4⤵
      PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
      4⤵
      PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      4⤵
      PID:8768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31530.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23242.exe
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        5⤵
        
        PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      4⤵
      PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
      4⤵
      PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
      4⤵
      PID:8380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5199.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exe
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        5⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        5⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
        5⤵
        
        PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23719.exe
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      4⤵
      PID:8696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1680.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38987.exe
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
      4⤵
      PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      4⤵
      PID:8464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8650.exe
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
    3⤵
    PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
    3⤵
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
    3⤵
    PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
    3⤵
    PID:8220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        5⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        5⤵
        
        PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
      4⤵
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
      4⤵
      PID:8032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
    3⤵
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
      4⤵
      PID:8664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
    3⤵
    PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
    3⤵
    PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
    3⤵
    PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
    3⤵
    PID:8672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      4⤵
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
      4⤵
      PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
      4⤵
      PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
      4⤵
      PID:8124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
      4⤵
      PID:8824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe
    3⤵
    PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
    3⤵
    PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
    3⤵
    PID:7284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
    3⤵
    PID:8420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8399.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
      4⤵
      PID:8012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
    3⤵
    PID:4000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
    3⤵
    PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
    3⤵
    PID:6648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
    3⤵
    PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
    3⤵
    PID:8776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
  2⤵
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
    3⤵
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
    3⤵
    PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
    3⤵
    PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
    3⤵
    PID:7412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
  2⤵
  PID:872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
  2⤵
  PID:3544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
  2⤵
  PID:5060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
  2⤵
  PID:6016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
  2⤵
  PID:924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
  2⤵
  PID:8084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe

Filesize
468KB

MD5
3515ec095418e1dc3f9b68e7edbd4fe9

SHA1
e9c47dfacce253c45b6db5d01a5f2573ad316047

SHA256
b2506ca9797cd341ec8616637b54bb3ed37427f51e165de1f7094aa3c8f44001

SHA512
f0ab204ecefcd7d43c40e8d97f21c7d3bad45f218042122f05e3f34356fadc52b2429629b0f4bb63e28dbea494c3664af65c9c832652215b20a7f186e912b3cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13861.exe

Filesize
468KB

MD5
6b7a4061184bb2b3197105c1d3e34b55

SHA1
ad7b5a018a93d7e404c213f3a8057d59ab12d6f5

SHA256
2eede2dc4052d99dacfa36e50f3eacd03b8ad8475d054714e7b33c9304b16219

SHA512
a7932b4b5236959c240c0942e16db86f90c4d28993874bdaa74779712bf91199c6f17b49412d654631185993bc563028041fb9f2a0f59d522dd36b2262587e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe

Filesize
468KB

MD5
37b85074291c65853a090db3384d3f54

SHA1
d93b08b7fe7c295b958e99fd6832f56ecdea4d2b

SHA256
f3d5c08bb158a8f947fdf9f72e361a62c65b881432f2034786bb166f2c46647c

SHA512
9833ea19aef3a412681a3a941e886cf839cf782b6639389eab36189cd5e0ecb7c627b95fd91a3110163109aaa7ba836be4d78d6a2242f6e8291500be1494abe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe

Filesize
468KB

MD5
5a6e2fab5353d58331668a18ebb54374

SHA1
41234e90a8504b87f69a5af7d4663663d2e3e4cb

SHA256
714fdf698d3023271e7b7abda90a5ed2a1341f396b522c03e1566affd024ca2b

SHA512
2468d588ac7067e64fa527efa4ff76bb7123fe71ea3b89b738b63497d76f7961e49c4898f013b8e3f064a2163a6f7d4a9b02a4529ec5acd911ff32d1752c8700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe

Filesize
468KB

MD5
8e4fd88359d539fcb00174670dae9c4d

SHA1
50a88a63259972d0da1a42f2126e732018d86d10

SHA256
0ba6a521712a44ce06b9930ebad36dbbffc06800931268abbd487a1c271ba6ba

SHA512
56f7b072f9e4f66b98b07c6f31035aac0141646e4f25e4486001e667783d8e00a74623c9a2dadacbbc8dd588348da9d4eff173d8ce06ee2c4b834a3bd3cfc06a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe

Filesize
468KB

MD5
ca39628d06ec632b47f3d8ee5b140daf

SHA1
e3f606b7befdd74dcaeb53dabd780818ae201c10

SHA256
b2bb2a88762001872bf548e5d63ee85db5a23643fde8d964891762e35d59b200

SHA512
59c3cb7df256a5916d435535660c933cb28fbfa73513279b03bd4d9e2e0fd2bb2a8c1b052478bda7a371e20af93c4857e5bdf9f10e664a8d1e94ea55f2f194cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe

Filesize
468KB

MD5
6f1e6078a822967b8b336412cdcc64d4

SHA1
dc56f26f2a49c586582d4e41e7b28572c891a7ff

SHA256
2ab42d82a4f125be3126d8e59bb4f70a3c45a0a0fd3634abd94459a289698c9b

SHA512
780b82d71342ba3421ad4313fbdb58d728afb7771f0da5cab8fe977b17b7c4c7c6aa958878c0a20a899ea3c19afecda5b0e51011022b2b9ee9b85aafcb38f910

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe

Filesize
468KB

MD5
49fcdd5c2e76eee76e0d8da772a8aa1f

SHA1
cd1b1deb6beb07e0dc0d9e41e5b19b253ad0e2bf

SHA256
0bcec557af9c99becda5e8b158c5af03208fb6189fb0e3138fc240c426f42500

SHA512
1626340cae62ccae8fa61c27c8849e9089423f9f91c6b5bd6809a3faa4452e0ee6e5a512d06318ce30731b2e2a80bdaee88371d0912ceec8182ab4dcd59cd8a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11495.exe

Filesize
468KB

MD5
ffec3484d14d75d286880b198b73d6d5

SHA1
210af414a24e11917d20d2794d06ed64f3b5d9e7

SHA256
d1e91b9b7d658262d56494e9ba60d764b9dd4d5ca52851adc4e43c1a6d701f12

SHA512
aa7d7203ce1fed3ae1593506e4ca1ed6b73af9465e31a29ee32b710253d42da0c0263e36a13a08b6b514114a542c8a573ce696d369c6c080ec629828d2610bf3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe

Filesize
468KB

MD5
47963a4e5fe09d96f8afce850ee3b67a

SHA1
ac8f2b5f8eab0892f3a41dad0054726249881617

SHA256
1333bf44a3b084d43d5d119fb1c1e747059893070306096ae7cf1d7d04668857

SHA512
2423b27c749490c8b12346dcb24b1a0e40839ba800e02ed21d08a4f8bf8cfcf5961155c4618d66c4e88b14b33e418e34e45d84e8813bb8f5f45ceacef8112cba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16472.exe

Filesize
468KB

MD5
ab4e6199ec99c088c62a09e9de3430c1

SHA1
48d49e6342f29baf1f5fd11be192b9b92ecd98d3

SHA256
f16a52d47f431697714be5e121680c075d758575c82a505d7d1fd689580fa340

SHA512
d34a4e207c051233fec6868286c0044823d9992e22e8e35cb7ef26cf845337d37e3259961437fd7f409e37b0ffacdb9e0daddc4240f1e334aa75be08ca54aebf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

Filesize
468KB

MD5
8baaa72dfa9021f323ed49853562d14f

SHA1
5a2e33bfa9dc83229ceb0d8680d6e57476426781

SHA256
3f815f4e0c50f59de390134c7a47caf6427626f131a187f6981ca7be5ce3ac30

SHA512
3ee488c874cbfee591e56febb7ab450ca3299c3b8ed31e9f3ebb2f4232b966148321f163554dfd5bee30b4c3d96e2d4d5b16f3184dfbec7ab15b59af4496cabf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe

Filesize
468KB

MD5
37cb19baf7e9e32d3cd75ca21a432313

SHA1
44622b4341ebbdd9d18420adab00a9e7c4cfa9a2

SHA256
4db7f066c44d4d1cdc78cc6b566819709338fe664a7ae78e945b98f9e6913079

SHA512
e687791f594da9c61bef8ea8f293c2beab1fbeb013f78930bac8acfaaa04b9b5ba16fdc02b4b5684eddb1b474a6805d66fbc874e19249b150a245149fe17abe0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe

Filesize
468KB

MD5
4e0d015f5c1bac5f1fc4454b9447c99c

SHA1
d94c65d88af949efdce404b5f769f1934d0207ae

SHA256
cb70bb0793c627286c78515b8dd4a8b6ab345be9956e8e36e7c2fb6d1615641f

SHA512
350f275a6e9b08ba1903d4379401233135073dfd5b93e236dd5168c9c3ca4d1615c4943fa59dfc913732b117bc8938cd2d904c6f1f8ecca8e1a7fb09e8a363f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe

Filesize
468KB

MD5
a0a45b543e8635a6c02f7528fbf14eae

SHA1
75bb8e984d986791b4478a563259a259d8db0af9

SHA256
6e4182594532c9f25df7b6876c5076f38041b1d3ca9cc6515207a7e40ab670e0

SHA512
190ac199e23aacaeef99edf9ee05f08d762dd9e199f660160234afcad3fddb128ef76ed57060d702140be13a2fb3752949a3663e29a57168eca14e51af83a184

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe

Filesize
468KB

MD5
6653f3575d0bc0abc28cc889b77a3ef8

SHA1
ee975c5945ea6ffdc3e08445566293477f1cc8ca

SHA256
cc51fe7c1f1115a64e804e3fbee4f1e54374fe594dbf0b379cb79abe31e1be8a

SHA512
1ee10c92fde20966354d402dfbbb822531cdfb8ab18538260f729f7dc34ef68fe7b66ea1122459a075264c0ca01f2ee8e8f3c220f960cb7742bc35915851b42e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe

Filesize
468KB

MD5
0105595234fe9d2a7837bab28eba0e9d

SHA1
7ec766e360a49c3c1a2acb07a4ec49fd756a9fb9

SHA256
7d7ecd7b88551a6fda4844a1159fa07c746dc71cb2f63e05c33c668f4c204118

SHA512
149d9ce3b1ecdd405c7bd3b444887f72a87c302d5cd6b5b253dfa635408467c5dcd75ca02417093966138351bdfc249b6a7063eb97af048ff704f9c2d2c38335

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe

Filesize
468KB

MD5
81dc1b2d3b488ae0f0a7b7ff9aa4e7d0

SHA1
cd5380c3137afd5a7d39f54ea1aaeb4e2561d70a

SHA256
5becacbb17ff7f27d7bafcd606df4e7ec2818b11ff341d33671b45fdbbbdc7d8

SHA512
20a396e7d2abea886f232e6d0cc738700c575e435f0ef642da230c7f1d6e8345f3a4c100a7227428bbdab6878445c029ff6a887b0635f0fc72d67bdd71765b90

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe

Filesize
468KB

MD5
a15f1dab344e985ae050122d6e5a3833

SHA1
600b2418d30c07d2f700cc4556d061b9bd07b501

SHA256
1164c2701dac772c23450de5c1538f24b8dc14b097ce3535460981487e6e7b77

SHA512
e08f450ae47984c4cdea2825133e2fd89f267749a02838c18ccfc08732e7907709af9c73a31206e472db35dee90ce55e24dc2028c3ac517f01343382e84136d3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe

Filesize
468KB

MD5
d2f2af6e0872d52650adbca6d8e3efb9

SHA1
6ca495e6df1d9c8b9b808f425b407440b733b7d7

SHA256
0f6ae266a810cbb26af943f9fe1a3c5fe70e1a0de45abd65c283cfd833ed6a2f

SHA512
c7e0c9f3173403de472b96170a4d5324d5ea966a75b67b5a93d8ad5a90d6810d5fef463e0953aab5bcc28da574e33f3d1ae0602c743874a1acd563404e394431

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe

Filesize
468KB

MD5
062f9684535d476cd95179515795e6bc

SHA1
6518a956771dcf575b07d06cdf949bba3a402f97

SHA256
21391f834261e93d19d87e6bcae7d52807c39502a95d737d065a4a8be6909bdc

SHA512
afdacf8146c9fe69e2af3fe649b0cef2f7f2d8a7475835a10e066f9030f495de5b1cbe2fdb299f56eeb545b137cd746a794b2787253a49911ff7218edbe7009e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads