361ad5a53f9ab68f00b45b8365998dc5fcfdfdfe948853533eab5326baddb1a1

Analysis

max time kernel
142s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe
Size

184KB
MD5

7b0dd07ac1f02dc674b8ffdd605a44e0
SHA1

6780480700ec44415a074f8a345279ad42c94917
SHA256

361ad5a53f9ab68f00b45b8365998dc5fcfdfdfe948853533eab5326baddb1a1
SHA512

d9bac642d3b758598b3566df393d451d8a90b85d04196c5d2ca3c71c5739a427eb21b5ba4e9ec446193b07a148e104a641fa4ff45409f8f5a2f296814a26c803
SSDEEP

3072:R+kQfgonQjR9lqXnY+he8sxzflvnqnxiuE:R+Qo6rqXM8kzflPqnxiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6088	Unicorn-20829.exe
4704	Unicorn-32783.exe
5740	Unicorn-62995.exe
5188	Unicorn-45103.exe
3204	Unicorn-12906.exe
1640	Unicorn-64708.exe
1516	Unicorn-6805.exe
764	Unicorn-52239.exe
2008	Unicorn-32181.exe
2568	Unicorn-4491.exe
3200	Unicorn-4491.exe
3216	Unicorn-4034.exe
1384	Unicorn-63706.exe
5592	Unicorn-9578.exe
3648	Unicorn-15709.exe
4468	Unicorn-4110.exe
3020	Unicorn-2034.exe
4476	Unicorn-54956.exe
400	Unicorn-61293.exe
2984	Unicorn-8796.exe
312	Unicorn-32786.exe
4788	Unicorn-52652.exe
2228	Unicorn-20364.exe
2800	Unicorn-20098.exe
5132	Unicorn-3434.exe
5292	Unicorn-55236.exe
5512	Unicorn-203.exe
5200	Unicorn-65475.exe
4716	Unicorn-48719.exe
2748	Unicorn-43762.exe
1924	Unicorn-47603.exe
5968	Unicorn-50447.exe
1144	Unicorn-26540.exe
4656	Unicorn-7250.exe
4652	Unicorn-53466.exe
4428	Unicorn-62092.exe
4448	Unicorn-25827.exe
2668	Unicorn-45071.exe
3292	Unicorn-58262.exe
5520	Unicorn-44303.exe
5356	Unicorn-48278.exe
4684	Unicorn-2606.exe
1476	Unicorn-2606.exe
5952	Unicorn-42077.exe
3888	Unicorn-20396.exe
2412	Unicorn-35663.exe
4940	Unicorn-53379.exe
5024	Unicorn-44714.exe
5324	Unicorn-47514.exe
5424	Unicorn-52684.exe
1492	Unicorn-33586.exe
4848	Unicorn-22979.exe
3612	Unicorn-47322.exe
5620	Unicorn-782.exe
5020	Unicorn-50860.exe
396	Unicorn-48364.exe
5760	Unicorn-6569.exe
5732	Unicorn-60979.exe
3116	Unicorn-57885.exe
1452	Unicorn-28690.exe
3548	Unicorn-15307.exe
3488	Unicorn-23855.exe
4552	Unicorn-63325.exe
5992	Unicorn-1685.exe

Program crash 13 IoCs

pid	pid_target	Process	procid_target
6388	5448	WerFault.exe	167
6276	3984	WerFault.exe	168
6812	5620	WerFault.exe	149
7020	5620	WerFault.exe	149
11404	5512	WerFault.exe	122
11672	12200	WerFault.exe	548
13264	5512	WerFault.exe	122
13476	4440	WerFault.exe	287
18396	17196	WerFault.exe	880
6204	16988	WerFault.exe	874
6628	16628	WerFault.exe	857
6528	5336	WerFault.exe	210
7072	5596	WerFault.exe	1044

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	10876	Process not Found
Token: SeChangeNotifyPrivilege	10876	Process not Found
Token: 33	10876	Process not Found
Token: SeIncBasePriorityPrivilege	10876	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe
6088	Unicorn-20829.exe
4704	Unicorn-32783.exe
5740	Unicorn-62995.exe
5188	Unicorn-45103.exe
3204	Unicorn-12906.exe
1640	Unicorn-64708.exe
1516	Unicorn-6805.exe
764	Unicorn-52239.exe
3216	Unicorn-4034.exe
2568	Unicorn-4491.exe
2008	Unicorn-32181.exe
1384	Unicorn-63706.exe
3200	Unicorn-4491.exe
5592	Unicorn-9578.exe
3648	Unicorn-15709.exe
4468	Unicorn-4110.exe
3020	Unicorn-2034.exe
400	Unicorn-61293.exe
4476	Unicorn-54956.exe
2984	Unicorn-8796.exe
5292	Unicorn-55236.exe
4788	Unicorn-52652.exe
2800	Unicorn-20098.exe
2228	Unicorn-20364.exe
312	Unicorn-32786.exe
5132	Unicorn-3434.exe
5512	Unicorn-203.exe
5200	Unicorn-65475.exe
4716	Unicorn-48719.exe
2748	Unicorn-43762.exe
1924	Unicorn-47603.exe
5968	Unicorn-50447.exe
1144	Unicorn-26540.exe
4656	Unicorn-7250.exe
4652	Unicorn-53466.exe
4428	Unicorn-62092.exe
4448	Unicorn-25827.exe
2668	Unicorn-45071.exe
3292	Unicorn-58262.exe
5520	Unicorn-44303.exe
5952	Unicorn-42077.exe
5356	Unicorn-48278.exe
4684	Unicorn-2606.exe
4940	Unicorn-53379.exe
1476	Unicorn-2606.exe
3888	Unicorn-20396.exe
5024	Unicorn-44714.exe
2412	Unicorn-35663.exe
3612	Unicorn-47322.exe
4848	Unicorn-22979.exe
1492	Unicorn-33586.exe
5324	Unicorn-47514.exe
5424	Unicorn-52684.exe
5620	Unicorn-782.exe
5732	Unicorn-60979.exe
1452	Unicorn-28690.exe
5020	Unicorn-50860.exe
396	Unicorn-48364.exe
3548	Unicorn-15307.exe
3116	Unicorn-57885.exe
5760	Unicorn-6569.exe
4552	Unicorn-63325.exe
5992	Unicorn-1685.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 6088	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	88
PID 2136 wrote to memory of 6088	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	88
PID 2136 wrote to memory of 6088	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	88
PID 6088 wrote to memory of 4704	6088	Unicorn-20829.exe	94
PID 6088 wrote to memory of 4704	6088	Unicorn-20829.exe	94
PID 6088 wrote to memory of 4704	6088	Unicorn-20829.exe	94
PID 2136 wrote to memory of 5740	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	95
PID 2136 wrote to memory of 5740	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	95
PID 2136 wrote to memory of 5740	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	95
PID 4704 wrote to memory of 5188	4704	Unicorn-32783.exe	97
PID 4704 wrote to memory of 5188	4704	Unicorn-32783.exe	97
PID 4704 wrote to memory of 5188	4704	Unicorn-32783.exe	97
PID 6088 wrote to memory of 1640	6088	Unicorn-20829.exe	98
PID 6088 wrote to memory of 1640	6088	Unicorn-20829.exe	98
PID 6088 wrote to memory of 1640	6088	Unicorn-20829.exe	98
PID 2136 wrote to memory of 3204	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	99
PID 2136 wrote to memory of 3204	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	99
PID 2136 wrote to memory of 3204	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	99
PID 5740 wrote to memory of 1516	5740	Unicorn-62995.exe	102
PID 5740 wrote to memory of 1516	5740	Unicorn-62995.exe	102
PID 5740 wrote to memory of 1516	5740	Unicorn-62995.exe	102
PID 5188 wrote to memory of 764	5188	Unicorn-45103.exe	103
PID 5188 wrote to memory of 764	5188	Unicorn-45103.exe	103
PID 5188 wrote to memory of 764	5188	Unicorn-45103.exe	103
PID 4704 wrote to memory of 2008	4704	Unicorn-32783.exe	104
PID 4704 wrote to memory of 2008	4704	Unicorn-32783.exe	104
PID 4704 wrote to memory of 2008	4704	Unicorn-32783.exe	104
PID 1640 wrote to memory of 2568	1640	Unicorn-64708.exe	105
PID 3204 wrote to memory of 3200	3204	Unicorn-12906.exe	106
PID 3204 wrote to memory of 3200	3204	Unicorn-12906.exe	106
PID 3204 wrote to memory of 3200	3204	Unicorn-12906.exe	106
PID 1640 wrote to memory of 2568	1640	Unicorn-64708.exe	105
PID 1640 wrote to memory of 2568	1640	Unicorn-64708.exe	105
PID 2136 wrote to memory of 3216	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	107
PID 2136 wrote to memory of 3216	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	107
PID 2136 wrote to memory of 3216	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	107
PID 6088 wrote to memory of 1384	6088	Unicorn-20829.exe	108
PID 6088 wrote to memory of 1384	6088	Unicorn-20829.exe	108
PID 6088 wrote to memory of 1384	6088	Unicorn-20829.exe	108
PID 5740 wrote to memory of 5592	5740	Unicorn-62995.exe	109
PID 5740 wrote to memory of 5592	5740	Unicorn-62995.exe	109
PID 5740 wrote to memory of 5592	5740	Unicorn-62995.exe	109
PID 1516 wrote to memory of 3648	1516	Unicorn-6805.exe	110
PID 1516 wrote to memory of 3648	1516	Unicorn-6805.exe	110
PID 1516 wrote to memory of 3648	1516	Unicorn-6805.exe	110
PID 764 wrote to memory of 4468	764	Unicorn-52239.exe	111
PID 764 wrote to memory of 4468	764	Unicorn-52239.exe	111
PID 764 wrote to memory of 4468	764	Unicorn-52239.exe	111
PID 5188 wrote to memory of 3020	5188	Unicorn-45103.exe	112
PID 5188 wrote to memory of 3020	5188	Unicorn-45103.exe	112
PID 5188 wrote to memory of 3020	5188	Unicorn-45103.exe	112
PID 3216 wrote to memory of 4476	3216	Unicorn-4034.exe	113
PID 3216 wrote to memory of 4476	3216	Unicorn-4034.exe	113
PID 3216 wrote to memory of 4476	3216	Unicorn-4034.exe	113
PID 2136 wrote to memory of 400	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	114
PID 2136 wrote to memory of 400	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	114
PID 2136 wrote to memory of 400	2136	7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe	114
PID 2568 wrote to memory of 2984	2568	Unicorn-4491.exe	115
PID 2568 wrote to memory of 2984	2568	Unicorn-4491.exe	115
PID 2568 wrote to memory of 2984	2568	Unicorn-4491.exe	115
PID 1640 wrote to memory of 312	1640	Unicorn-64708.exe	116
PID 1640 wrote to memory of 312	1640	Unicorn-64708.exe	116
PID 1640 wrote to memory of 312	1640	Unicorn-64708.exe	116
PID 1384 wrote to memory of 4788	1384	Unicorn-63706.exe	117

C:\Users\Admin\AppData\Local\Temp\7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7b0dd07ac1f02dc674b8ffdd605a44e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20829.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        9⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        10⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        11⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
        11⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        11⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        10⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        10⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        10⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        10⤵
        
        PID:18352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
        10⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
        10⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        9⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        9⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53720.exe
        9⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        9⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        9⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        9⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        9⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        9⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        9⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        9⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe
        8⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        8⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        8⤵
        
        PID:17784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        9⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        9⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30490.exe
        9⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        9⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        8⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        8⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        7⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        9⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
        9⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        7⤵
        
        PID:17196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17196 -s 464
        8⤵
        Program crash
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
        8⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        9⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        9⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65393.exe
        9⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        9⤵
        
        PID:17776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
        8⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        8⤵
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64141.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        7⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
        7⤵
        
        PID:17568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57330.exe
        7⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        6⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        7⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        8⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        8⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
        7⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
        7⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
        6⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        7⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
        6⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        7⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11499.exe
        8⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3470.exe
        9⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        10⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        10⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        10⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        9⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        9⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        9⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        9⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        9⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63478.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        8⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        8⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        8⤵
        
        PID:17904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
        7⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
        8⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        9⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
        9⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
        8⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        8⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        8⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        8⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
        8⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18521.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        7⤵
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22546.exe
        6⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        8⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        8⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        8⤵
        
        PID:16628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16628 -s 436
        9⤵
        Program crash
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        6⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        7⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        7⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        7⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        6⤵
        
        PID:17836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        6⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
        7⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44168.exe
        8⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        8⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        7⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18080.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-373.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52268.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        7⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
        7⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        7⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe
        7⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        6⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9858.exe
        5⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64915.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
        7⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43904.exe
        7⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 80
        8⤵
        Program crash
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
        6⤵
        
        PID:16988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16988 -s 460
        7⤵
        Program crash
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16762.exe
        5⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        6⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        5⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        8⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        8⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        7⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        6⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        7⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exe
        7⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15936.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        6⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        5⤵
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19045.exe
        6⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
        6⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7838.exe
        5⤵
        
        PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        6⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        7⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
        8⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        8⤵
        
        PID:18364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        7⤵
        
        PID:18124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        7⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        6⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11733.exe
        7⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        7⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        6⤵
        
        PID:15564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        6⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        5⤵
        
        PID:17864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65468.exe
        5⤵
        
        PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        7⤵
        
        PID:18084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe
        7⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        6⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        6⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        5⤵
        
        PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
      4⤵
      PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
        5⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16026.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
      4⤵
      PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
      4⤵
      PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
      4⤵
      PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
      4⤵
      PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        9⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        9⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        9⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exe
        9⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
        9⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        8⤵
        
        PID:18296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        7⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        8⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
        7⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33475.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        8⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        7⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        7⤵
        
        PID:17792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        7⤵
        
        PID:17736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        6⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48436.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        7⤵
        
        PID:18036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
        7⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        6⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        5⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55037.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        7⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        5⤵
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        5⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        5⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        5⤵
        
        PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40783.exe
        6⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        8⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        8⤵
        
        PID:18108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        8⤵
        
        PID:17900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
        7⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        7⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        7⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        6⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        6⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10192.exe
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        5⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17591.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        5⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        6⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        6⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        5⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
      4⤵
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2347.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        5⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        5⤵
        
        PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
      4⤵
      PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
      4⤵
      PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
      4⤵
      PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
      4⤵
      PID:16956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        6⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        6⤵
        
        PID:18252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        6⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        5⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe
        6⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30311.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        5⤵
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
        5⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        5⤵
        
        PID:18232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        6⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20391.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
        6⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        6⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        6⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24055.exe
        5⤵
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        5⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
      4⤵
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        6⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64731.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
        5⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        5⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
      4⤵
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
      4⤵
      PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        5⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        6⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        7⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        7⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        6⤵
        
        PID:18408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52522.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
      4⤵
      PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        5⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        5⤵
        
        PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
      4⤵
      PID:18368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
      4⤵
      PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51980.exe
        5⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        5⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
        5⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        5⤵
        
        PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
      4⤵
      PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
      4⤵
      PID:13180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
      4⤵
      PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
      4⤵
      PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25426.exe
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
      4⤵
      PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
      4⤵
      PID:18208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
    3⤵
    PID:7744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
    3⤵
    PID:11164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
    3⤵
    PID:14068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
    3⤵
    PID:16968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
        7⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        8⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        9⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        9⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        9⤵
        
        PID:18260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        8⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        8⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        8⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        8⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        7⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        7⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        7⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        7⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15605.exe
        6⤵
        
        PID:14160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18796.exe
        6⤵
        
        PID:18076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19090.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        7⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        6⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11122.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11442.exe
        6⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        6⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        5⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
        5⤵
        
        PID:17460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        6⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65051.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        6⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        6⤵
        
        PID:17532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe
        6⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21498.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6144.exe
        5⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        5⤵
        
        PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        5⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        6⤵
        
        PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        5⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
      4⤵
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5815.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
      4⤵
      PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
      4⤵
      PID:11308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
      4⤵
      PID:14564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
      4⤵
      PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
      4⤵
      PID:7884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9578.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 632
        6⤵
        Program crash
        
        PID:6812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 676
        6⤵
        Program crash
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56410.exe
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        6⤵
        
        PID:4936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 652
        6⤵
        Program crash
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30311.exe
        5⤵
        
        PID:7888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 504
        5⤵
        Program crash
        
        PID:11404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 660
        5⤵
        Program crash
        
        PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58600.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        6⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        6⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        5⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        5⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        5⤵
        
        PID:17428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
      4⤵
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1207.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        5⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        5⤵
        
        PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
      4⤵
      PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
      4⤵
      PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
      4⤵
      PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        5⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55372.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        5⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59791.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exe
        6⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        6⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        5⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
      4⤵
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        5⤵
        
        PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
      4⤵
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
      4⤵
      PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
      4⤵
      PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
      4⤵
      PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        6⤵
        
        PID:18292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47296.exe
        6⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
        5⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        5⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
      4⤵
      PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
    3⤵
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
      4⤵
      PID:4440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 632
        5⤵
        Program crash
        
        PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
      4⤵
      PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
      4⤵
      PID:14020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
      4⤵
      PID:17852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
      4⤵
      PID:7844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28042.exe
    3⤵
    PID:7872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
    3⤵
    PID:11124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
    3⤵
    PID:13784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
    3⤵
    PID:16932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
        5⤵
        Executes dropped EXE
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        7⤵
        
        PID:17520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        6⤵
        
        PID:18196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
        6⤵
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        6⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        7⤵
        
        PID:17684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        5⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64758.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        5⤵
        
        PID:17768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
      4⤵
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1159.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        5⤵
        
        PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
      4⤵
      PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
      4⤵
      PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
      4⤵
      PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
      4⤵
      PID:6640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        5⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7886.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        6⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        6⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        5⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44950.exe
      4⤵
      PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        6⤵
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        5⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
      4⤵
      PID:13828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19968.exe
      4⤵
      PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-684.exe
      4⤵
      PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
      4⤵
      PID:18016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        6⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
        5⤵
        
        PID:17584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55372.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        5⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18736.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
      4⤵
      PID:13632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
      4⤵
      PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
    3⤵
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
        5⤵
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1287.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9596.exe
      4⤵
      PID:12944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exe
      4⤵
      PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
      4⤵
      PID:116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
    3⤵
    PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    3⤵
    PID:9956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
    3⤵
    PID:12884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
    3⤵
    PID:5280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49423.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4007.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
        7⤵
        
        PID:17616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
        6⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
        7⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44196.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        5⤵
        
        PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61757.exe
      4⤵
      PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        6⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
      4⤵
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18330.exe
        5⤵
        
        PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
      4⤵
      PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
      4⤵
      PID:13596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
      4⤵
      PID:1940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
      4⤵
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61437.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59855.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe
        6⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        5⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        5⤵
        
        PID:18096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
      4⤵
      PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51704.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
      4⤵
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      4⤵
      PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
      4⤵
      PID:17332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe
    3⤵
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
      4⤵
      PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4003.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        5⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57473.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
      4⤵
      PID:18244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48518.exe
    3⤵
    PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
      4⤵
      PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
    3⤵
    PID:8792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe
    3⤵
    PID:12200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 12200 -s 212
      4⤵
      Program crash
      PID:11672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
    3⤵
    PID:14248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
    3⤵
    PID:16560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
    3⤵
    PID:17464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
      4⤵
      PID:3984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 632
        5⤵
        Program crash
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        6⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        5⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exe
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
      4⤵
      PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe
      4⤵
      PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
      4⤵
      PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
      4⤵
      PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
    3⤵
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
      4⤵
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2645.exe
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        5⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        5⤵
        
        PID:17560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38034.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
      4⤵
      PID:17164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
    3⤵
    PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
      4⤵
      PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
      4⤵
      PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
      4⤵
      PID:17592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
    3⤵
    PID:8876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
    3⤵
    PID:11476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
    3⤵
    PID:15076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
    3⤵
    PID:18376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
    3⤵
    PID:6900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
    3⤵
    PID:5448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 632
      4⤵
      Program crash
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
    3⤵
    PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26031.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41984.exe
      4⤵
      PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
      4⤵
      PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
      4⤵
      PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
    3⤵
    PID:8936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62801.exe
    3⤵
    PID:12264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
    3⤵
    PID:14360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
    3⤵
    PID:18236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
  2⤵
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
    3⤵
    PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
      4⤵
      PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
      4⤵
      PID:14204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40637.exe
    3⤵
    PID:9392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
    3⤵
    PID:13780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-512.exe
    3⤵
    PID:17392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
  2⤵
  PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
    3⤵
    PID:9824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
    3⤵
    PID:12628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
    3⤵
    PID:15808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
    3⤵
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43712.exe
    3⤵
    PID:17128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
  2⤵
  PID:8900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
  2⤵
  PID:11800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
  2⤵
  PID:14576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46676.exe
  2⤵
  PID:18224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
  2⤵
  PID:7068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3984 -ip 3984
1⤵
PID:6848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5448 -ip 5448
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5620 -ip 5620
1⤵
PID:7100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5620 -ip 5620
1⤵
PID:7716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5512 -ip 5512
1⤵
PID:11728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12200 -ip 12200
1⤵
PID:10012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5512 -ip 5512
1⤵
PID:13292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4440 -ip 4440
1⤵
PID:13448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2904 -ip 2904
1⤵
PID:18272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe

Filesize
184KB

MD5
3815356ea3e3532647bb3f2c4958a738

SHA1
bd2a5c439d694639295102bd476ee9f3817b9a68

SHA256
487f8de884f056c4721cfca27251a35a330960c9a91b0de199ee9a868aa75fbc

SHA512
22dd574fee1aa9ca9fd21a6dc24b97dff28b28d6da74350275c0e6ac84c48ec05bc8d007954526b71923e41c9570ede9046fb4c7fb2e38553f7dc4d1917bfa23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe

Filesize
184KB

MD5
8acedfd92273da1b034ccbfc90943ff6

SHA1
a2eb68c2df7596c06a3b8edfb39f9b98c127a365

SHA256
b37c71e89c11fdcaa7babaa70eabfec8bc020718c4b6896c53fd094c02c883ad

SHA512
4d9f71258f5d024cdf9ab69a48dd81ed3e951ef5ecb6b2757bd5416fd2dc58ab9ecf4646670910e6e4c4afa8cc73b359ee0213320e4d29fdd1cff49454d539af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe

Filesize
184KB

MD5
3598cc640703b7480f12d9f315120a73

SHA1
e1a502e6b63b0cfbf499170c4535da21ef75c47a

SHA256
c00fe30a7da0f68552caeaf8dbc9dc9955089decf4d26172d8609035fa1939f7

SHA512
cdc2f72a5962c58376a6ea6a81a672ec165d96bd72d7bea5aa723a36bab497f7d4b0d85db08e39c8ad224e2359ab18eeae81fe96395dfcc379fefbbfe5b437e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe

Filesize
184KB

MD5
213080cfd8392225e471710f0cf53036

SHA1
3f0646def6aea03a0d3e68997a1eb98567e95550

SHA256
344938a8080bbd56d315df692ee98469efae110da90673503cbfd4d0546aab6c

SHA512
63b7fc5e48793348eb2f146a7e64a06f24bfc85d4960e09f1c39b55f3f5d81cc9aed8826792a5dc3dcfa9e8eaaee40a0ee7f75664fdae6bc24b2f7b027750121

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe

Filesize
184KB

MD5
982ef3068ecb2bceaadcc5c7c79ea07a

SHA1
0ddf5500fb3e260173caebd53bb34408a5b3c51d

SHA256
647e0d830811cecd8c3b174ad4c63218ff5fb57506d20f58241ba5f775686509

SHA512
57de1518e26e3406c025c56f4c377fef8c6482a38a63ea28d9b939bfdec4b62d47804f94fc3a564e29c225857495339720d2c6dcb7f4e12f91df6c666870f7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe

Filesize
184KB

MD5
ed92383830f6a1579701c44b17d2a9f9

SHA1
6d931132a716cfd6bc416f0ddfe0111378a4ac8e

SHA256
432988a27a5f0011e70fa9bef6bbb01f00d6238cbc894ca9a39ad28153327aff

SHA512
354cfac56cd88d6563ebdcf4c68f0c7bb9d5fad50664f3432d377fe608fdd18cbb2edeffa2362a608cd994b7b49d7a6aec4ab76da59eef44a4a3c381391bf3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20829.exe

Filesize
184KB

MD5
7ebc79681c59fcec986a736b32bfc41a

SHA1
e18ebecca9b436b0da315e7e13d9d13efaaed0e0

SHA256
8b9057391e02988eff67b365d3e203539b045cec14e9edc859be9095750039ec

SHA512
42dd1aae7fbaf26c53d2eba9be525be2dc97053dfbad79f7aeddce7208ab141bb992c6672a1d1837b84f1078ddedba994afa3c074dbbadbcbb247e09b78f875f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe

Filesize
184KB

MD5
e541a685a990e7adaa255138719bc62b

SHA1
0f67d003f324ba748272fcf28b34de3c7ffad8e5

SHA256
cdec3785c23da7f3eaa17db70bca2d8777476e70eef93e67ec669d68c01121b1

SHA512
63715d1ef6dea471469b91b253374df202ead81e031e8ee8a1641098903847561145baaab9233ad2b27e04bde9d268a694d3ff687c85ed0bb1ff6b23b776f538

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe

Filesize
184KB

MD5
4b12eff50531bbcca524addc42814597

SHA1
ff7274092ebd5bfb319f53512dc0215fe0af76a2

SHA256
636ea4dd0b36674649efa234437707448e814e03d592de46b734a4cc3a2d067a

SHA512
37cde9a5cca03e1a568f18940e0d00eb4f7934247ffd846e8fa986e9d9a1add3ca7bc13fb846549bd55964e349e904e76d38b975fb4e2e693521576293bc0d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32786.exe

Filesize
184KB

MD5
d6e50bc40fb22c2764b33e34c7182f1d

SHA1
950e5fbf5845a0484e3fce6bea19f61196b67c38

SHA256
290d3daf08e7e807893c8badd43ad9a199e4b65fc143bd0f897bbd4dc1b12ef6

SHA512
f17c1ed41bfb9cabccf361dcf79cc32ea25f4b53733b474d3e34e717740766d2a20f69e4b9851d09d0c14041cfb19258ddf3664112b96e775b8a0119ee88576f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe

Filesize
184KB

MD5
04e743a87612a66c4a43a4fbcd9ea3c7

SHA1
aa0fab3b164e19c9bb17197578a758d274c47078

SHA256
1202d3400aceca3218c5843b8d3af9ad7fd7b8ea96f4391ef2421c5a5bd0c03c

SHA512
6e56889307c4b33551332053100bc7a42cfa2f7009be01302634fdc44c53d4bd4379240d3e515b470b7f54b0860673b61d116636f4673f9cb0571ddcd86849b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe

Filesize
184KB

MD5
94054887b20394c46e1175f35cf6cf8e

SHA1
f2e4049aaec724a641b257cd2c89eb76a46bee60

SHA256
b4b34c13f57d48d42d804fd27da2e02970bae7a952e2de77d60019c0f47edb74

SHA512
ccd237d3bd8769e9ab46880272beea19ac64d6c317bc1b045614940d8ee615bd5d4f903ceedd922b12c8b15d14bd5a7f4822725e1a53c824a48a633247016f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe

Filesize
184KB

MD5
a21d93c51324f0ca5150086f6bddc61b

SHA1
10401e1d34d77ce20425fbc9173764471cd438b9

SHA256
d82ccf7ed1685ecaca1ef5f42fe2fddca303e2e6f1d6194e05eb41cf893c4fef

SHA512
cae6494ba2b247b0c96ef42173db61a72d523218b589ee5f8d619015eef30fc50e0539c28440777f500533b94858d2d9bc4e982d397e10cef0fb56e8b41891ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe

Filesize
184KB

MD5
5cc5eceb92a31e8f46f73f6e4a04aad4

SHA1
1bdfaa439dba1448ca465fb1566e7cbc130c7b35

SHA256
9b7d45580ff4c7d60530ab6c4bbc05add333f577bf143ecc331e388f6dc208b6

SHA512
ec05e158a268437fca4dc38ff9188f899e151ef01e861cc3ccf37562eb0671376ef8d0a97f43447053577595f0ddebb631251c1dbe196656b50bd6ed8d678d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe

Filesize
184KB

MD5
a26cf190c6b2202e3aab69fe4aba9985

SHA1
fe5691cddfa76c0a8dc39a10cc289eba23068919

SHA256
8d9e9ab9b81a7555ccfb7fc854cbdf50a30cc961beabfcc40950ab81e3149c49

SHA512
3fce2c286570c23439ea9d9788b960f6b9fab3ac56d2409a11d01f8e1fa49d432e1e6e0c3ece5d2a6775599315fff9529a92d788127698e78053c94c8d62f6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45103.exe

Filesize
184KB

MD5
2dee9245a4b288906754d62ca6b8e0f1

SHA1
b47805c4e9fae18f0cc3a0fcb4b1737ed72cdfa6

SHA256
ebf1bc155c2f3813e153418656e38ce8b516514532b94832abc0fdb97e89a1fd

SHA512
1bcb582d3b5ba9d9cc2fa44581425f521d187809ae7fa7c07cf09cb1efd4c118f36dfeaa560cec48cd27a59c8a3e7ba950ad1730fa6f51ae87cdae4ae9112d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe

Filesize
184KB

MD5
1c0ebf9357e35ef82a3cbc19edac18ee

SHA1
825c80577c378681412012069d0af634b78a420d

SHA256
6cc710c3192b0a0bec6723b57654f3fe9dfb872e2a45453c853847e254c08ed3

SHA512
5884cebba475ed58749bfc7df7a0228a34b750a5864e7e7977a900f18923871a9a2fd6d11ee7aa72dc490615526cf5f6d68357dc627b71e80d6593e879dd7ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe

Filesize
184KB

MD5
8fae2e21d61644a6558f5fcbf7420f48

SHA1
52e85bfb2a8607f0b07fb115695da5bb6621107a

SHA256
3cf5d411360a0268206b6747ed5cce31fcd798f38fa6ea63325bef8e64a305fc

SHA512
344a1661bafacab8fd036fba402168430e0946dff2d6b76578ea00f005b93904bfa19f7e5010c924dab0a8a62426d0456d6b2db01ba175d9678022082b7b1a42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe

Filesize
184KB

MD5
2e3c442b795c5325d09e68002c1dc742

SHA1
aade97ec568a28f322b7163f9fc4f0a9eee0c94d

SHA256
0f6e455d550babec0350fc096cfd9230fc8a300591364b7d7472de8b4db6129f

SHA512
9f93805441039c11e70db45797633019b4f35f43c109ca42d74293cd0f2ad46b69c1b1718b171c98588d1a24bfcbb4b110ee88150140b00d0e3fd67faf053ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52652.exe

Filesize
184KB

MD5
fd446b717dfd164d0673a8c0fc0df9ca

SHA1
c1ba41dc8e792080db18a64b2f2d3b3a3f8efb4a

SHA256
364d4b76858d5300743350a1bf9394f3983f865034f57c8fbb6d5363675fec0c

SHA512
13ba114436fb28bc98e0c68e8f093337488c829ce868a036c22b85967f7c91d3a4d2fd6ebf483c8a7010650435c6ec360ddb1fe9427a2ddd91cff5d2368cf9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe

Filesize
184KB

MD5
21cee6b5fd1dae5917f70f7d0ce0c5b7

SHA1
dcd4a20a1c31c811927db049ec363b3f66e5ef31

SHA256
baf060408bb0858dfdc76371f603d56190b4f0a93094524e812bd05e43bc74da

SHA512
c2bb9371312bbebd66de644125f459e6d973051335607faf461c625dad79771f9f0548dcb03049df15669dfa38c196b0ce2ad654d6b19898b501fe2d266459e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe

Filesize
184KB

MD5
455d37b544600fb6e2e9ae080cf35c87

SHA1
03b5ac797da6526fd9f7f4d22a3bb432486bd54c

SHA256
381b811e4ee0eed7e16b1bc1a25327383d21d514dde18dd797f5dbb845df5413

SHA512
4c0a14e40370cf345921c6550d5469cce1af48f884cb53a5a12978629fb3f5647689849d33d2393dd9611a8f6afd77764f6eae1a62c469d32b09a25237e09153

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe

Filesize
184KB

MD5
c0df664bd263be27dd54450d94f39df4

SHA1
fb315902daaf5f1e82832484339d7b36daf35459

SHA256
0197746f181af1acd95c876618f2891f2defaba93f59f0d7bec82f87d34c8556

SHA512
a23f08110bc882f9f40f5c97a57afac42c05ee3a663cde5a5d7036a3a40c8921300dfcbabc8a7b20e1d3dc43b86c7c34c866c7e0fec6d10b51020eb28617f1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe

Filesize
184KB

MD5
88504a7159e77d4fea5e5ed7f56ec722

SHA1
bebd50dc150967d7d06fb182b84914ffaf4a10ec

SHA256
1205126d174b44a58a23946696cc17017ed55b6fa784c090777f33ec1ad6301d

SHA512
9e04d279901178629c2d3503d38611655e53fb2a4395b4a04482c006dba4e628f68766c43694618ef73447d6c8e0fa27cbd9cc1f4e6e35484eaddf87b2ddaec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe

Filesize
184KB

MD5
11082699a32f8cac5df5380b9a0fdeed

SHA1
784fa24b07a2457c06ebe8262ca765459bdbf839

SHA256
b2b811baf3f13f6746dc9ae7c7e1f6a7b6cdd936c1c4a8124c16dd5551a1d249

SHA512
7798973aa9cdc0571a5c9a1febd16329992c879e4e4011283fd62bbd8d6a1661243e91d45f405d234d2c7640abb7971e9fcf7c4cf50d4753a7b582a6bf1277d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe

Filesize
184KB

MD5
0c74102ff49d63fbbc0df872289165cb

SHA1
d3790554e6e41bcee1d7b239ff04d795405901a7

SHA256
f1039234496644407b59875327bff6a1f3bbedd362da35a517ec7bdda782dbcd

SHA512
1082ea73200c725fb01fac993c6fec10712c8fa34a391517008e63fcd26d1fb045a85ac849fcd9816e456b2c8cba412835d299dcb6e6c98536807097e23df0fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe

Filesize
184KB

MD5
4a0d14236ffbddd7431cf5b973a26ea2

SHA1
adfc4ba53b0fd9c061088e6370682757623fc65a

SHA256
7bdf34c04a2a0ffa929f0ded2cf95306364b09580c0b5dc1759e4644368ecc61

SHA512
17db9c32f55032b7a1bd351ad5b10937023e3a0949fd0538efd9744049979acb2ca8211425f1bafa056133efd7be4c37ad9cab623071a8d3ad9d2f50d6c7a1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe

Filesize
184KB

MD5
1f9bdf4085dafcf4bbe927fca7fd7af8

SHA1
9b446eb5e0a2706ae3436dc8685362c6dfaed431

SHA256
82dc099c46bf04f4fa678ad257cb60731e2b36dbc9dc5f447a1222edd3b6850a

SHA512
09275dd460db18b46649bbe167fac2ba68a91d0a5a2c23cd3930dbfae76e8a602ad7094e3652d7cc420f6de589782e326b89a7fb2496d48058c63d43d5015739

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe

Filesize
184KB

MD5
8b59841bcab0e609ff2de8f11a185427

SHA1
7949e6e953e8691f3485362cc1309fe13e5bbf6d

SHA256
8b4a57a230c25b55850f1269672b43ba43344ea77c7891d9f5edf5055f094faf

SHA512
ffb5d78415dcdbb2378d8b66b93babf0cf27e0ebe4b52c7dce0b73ff50072b4880303f6ef096d46ee2ae1280b921ce61abfd71d20121b260d2e160f6c36c7cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe

Filesize
184KB

MD5
8793cf24b32ebea559cb3c9f21f17f7b

SHA1
c489216d6d9389526cf15c6417d4a17f10f2d8dc

SHA256
2cc2b3b7cce4b890de856fe26d296879bd31620b2a64bf3dab8556999737f0de

SHA512
2de8fbc661fe7becd06e723d2884c50a9ad81a57ee61a4a37e8cdc12cef3af44abd56af353bf16fbdabc5358d015294f9673016ac0fb4427fe26bb90384bc36a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9578.exe

Filesize
184KB

MD5
77678a733ce6d8481af59a42d860ee10

SHA1
00c4bbfce049c1146555a3102fdfbdecb7be8a2a

SHA256
021789f7e2a6e400c6489280171cef3489793cac88b43210243a12e94599449a

SHA512
0595a7a8e422a0e4b4890b129936cb0b2c74ceea751cbb88ed043a262c84f21afc22211106e964232a3b9122dea29a470129f2a7a6d6153433cd1af25b551e45

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads