38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe
Size

184KB
MD5

a451ae3805847608703d8b96270fb01e
SHA1

0b4e736a7a9a7db1cb4e6c7b513a27b36578de06
SHA256

38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd
SHA512

3e5da2a652d8a7ae268a0d2bb4d27c2e32b51a4ef7af0d90283e72a8b7dc7c65a82a533c051cd1b9de54d47f6b5afe3a2c7e011d58442687591d82f422bc6dd8
SSDEEP

3072:ngIcLkoRv6SAd48tWNb8IEm8lvMqnviu4:ng8oR848u8xm8lEqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4212	Unicorn-37408.exe
2596	Unicorn-18140.exe
4468	Unicorn-33084.exe
1452	Unicorn-8949.exe
1980	Unicorn-15071.exe
4964	Unicorn-1336.exe
4404	Unicorn-33214.exe
4188	Unicorn-27014.exe
3924	Unicorn-27014.exe
4992	Unicorn-106.exe
4392	Unicorn-39266.exe
1912	Unicorn-25622.exe
5040	Unicorn-39358.exe
2404	Unicorn-54708.exe
1128	Unicorn-5415.exe
4296	Unicorn-26582.exe
2804	Unicorn-26604.exe
1928	Unicorn-53801.exe
2484	Unicorn-8129.exe
4852	Unicorn-14351.exe
1460	Unicorn-8221.exe
1788	Unicorn-49162.exe
4356	Unicorn-49162.exe
4032	Unicorn-22254.exe
4856	Unicorn-37464.exe
5084	Unicorn-13589.exe
2880	Unicorn-57906.exe
404	Unicorn-63671.exe
1212	Unicorn-40008.exe
1448	Unicorn-19588.exe
4976	Unicorn-65259.exe
3084	Unicorn-56244.exe
4732	Unicorn-33594.exe
2468	Unicorn-17812.exe
3404	Unicorn-15888.exe
760	Unicorn-46614.exe
1396	Unicorn-58866.exe
4940	Unicorn-45852.exe
4968	Unicorn-45031.exe
2400	Unicorn-40946.exe
2544	Unicorn-60812.exe
1304	Unicorn-7527.exe
4780	Unicorn-17834.exe
2948	Unicorn-11703.exe
388	Unicorn-57905.exe
3728	Unicorn-13749.exe
2452	Unicorn-13749.exe
4676	Unicorn-26002.exe
4568	Unicorn-2052.exe
3628	Unicorn-21652.exe
2084	Unicorn-46977.exe
4040	Unicorn-21817.exe
1272	Unicorn-56920.exe
3904	Unicorn-32970.exe
4224	Unicorn-22110.exe
2028	Unicorn-46584.exe
5000	Unicorn-8451.exe
620	Unicorn-29426.exe
3912	Unicorn-51238.exe
1052	Unicorn-51238.exe
1328	Unicorn-43624.exe
3420	Unicorn-32855.exe
2608	Unicorn-53184.exe
4932	Unicorn-48835.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1736	4404	WerFault.exe	102
16596	16532	WerFault.exe	821

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
18460	Process not Found
18536	Process not Found
18544	Process not Found
11876	Process not Found
12140	Process not Found
12492	Process not Found
12160	Process not Found
8396	Process not Found
12652	Process not Found
12660	Process not Found
8728	Process not Found
18608	Process not Found
18616	Process not Found
11352	Process not Found
11448	Process not Found
12732	Process not Found
13096	Process not Found
13160	Process not Found
1948	Process not Found
13268	Process not Found
13272	Process not Found
13256	Process not Found
11796	Process not Found
18628	Process not Found
18648	Process not Found
18680	Process not Found
10208	Process not Found
1688	Process not Found
10676	Process not Found
6456	Process not Found
10160	Process not Found
10468	Process not Found
11280	Process not Found
11688	Process not Found
212	Process not Found
18480	Process not Found
18492	Process not Found
18740	Process not Found
11724	Process not Found
13228	Process not Found
18672	Process not Found
18596	Process not Found
18692	Process not Found
18700	Process not Found
18632	Process not Found
18736	Process not Found
18688	Process not Found
10768	Process not Found
18748	Process not Found
18436	Process not Found
10148	Process not Found
12448	Process not Found
18468	Process not Found
18772	Process not Found
18516	Process not Found
18744	Process not Found
18716	Process not Found
8260	Process not Found
18484	Process not Found
11316	Process not Found
11488	Process not Found
11584	Process not Found
792	Process not Found
18848	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5008	dwm.exe
Token: SeChangeNotifyPrivilege	5008	dwm.exe
Token: 33	5008	dwm.exe
Token: SeIncBasePriorityPrivilege	5008	dwm.exe
Token: SeCreateGlobalPrivilege	11584	Process not Found
Token: SeChangeNotifyPrivilege	11584	Process not Found
Token: 33	11584	Process not Found
Token: SeIncBasePriorityPrivilege	11584	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe
4212	Unicorn-37408.exe
2596	Unicorn-18140.exe
4468	Unicorn-33084.exe
1452	Unicorn-8949.exe
4964	Unicorn-1336.exe
1980	Unicorn-15071.exe
4404	Unicorn-33214.exe
4188	Unicorn-27014.exe
3924	Unicorn-27014.exe
1912	Unicorn-25622.exe
4992	Unicorn-106.exe
4392	Unicorn-39266.exe
5040	Unicorn-39358.exe
2404	Unicorn-54708.exe
1128	Unicorn-5415.exe
4296	Unicorn-26582.exe
2804	Unicorn-26604.exe
4852	Unicorn-14351.exe
2484	Unicorn-8129.exe
1788	Unicorn-49162.exe
1928	Unicorn-53801.exe
1460	Unicorn-8221.exe
5084	Unicorn-13589.exe
4856	Unicorn-37464.exe
4032	Unicorn-22254.exe
4356	Unicorn-49162.exe
2880	Unicorn-57906.exe
404	Unicorn-63671.exe
1212	Unicorn-40008.exe
1448	Unicorn-19588.exe
4976	Unicorn-65259.exe
3084	Unicorn-56244.exe
4732	Unicorn-33594.exe
2468	Unicorn-17812.exe
3404	Unicorn-15888.exe
760	Unicorn-46614.exe
1396	Unicorn-58866.exe
4940	Unicorn-45852.exe
4968	Unicorn-45031.exe
2400	Unicorn-40946.exe
2544	Unicorn-60812.exe
4780	Unicorn-17834.exe
388	Unicorn-57905.exe
2948	Unicorn-11703.exe
1304	Unicorn-7527.exe
3728	Unicorn-13749.exe
2452	Unicorn-13749.exe
2084	Unicorn-46977.exe
4040	Unicorn-21817.exe
4568	Unicorn-2052.exe
4676	Unicorn-26002.exe
3628	Unicorn-21652.exe
1272	Unicorn-56920.exe
2028	Unicorn-46584.exe
4224	Unicorn-22110.exe
3904	Unicorn-32970.exe
5000	Unicorn-8451.exe
620	Unicorn-29426.exe
1052	Unicorn-51238.exe
1328	Unicorn-43624.exe
3912	Unicorn-51238.exe
3420	Unicorn-32855.exe
4932	Unicorn-48835.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4212	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	91
PID 1984 wrote to memory of 4212	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	91
PID 1984 wrote to memory of 4212	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	91
PID 4212 wrote to memory of 2596	4212	Unicorn-37408.exe	95
PID 4212 wrote to memory of 2596	4212	Unicorn-37408.exe	95
PID 4212 wrote to memory of 2596	4212	Unicorn-37408.exe	95
PID 1984 wrote to memory of 4468	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	96
PID 1984 wrote to memory of 4468	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	96
PID 1984 wrote to memory of 4468	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	96
PID 2596 wrote to memory of 1452	2596	Unicorn-18140.exe	98
PID 2596 wrote to memory of 1452	2596	Unicorn-18140.exe	98
PID 2596 wrote to memory of 1452	2596	Unicorn-18140.exe	98
PID 1984 wrote to memory of 1980	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	99
PID 1984 wrote to memory of 1980	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	99
PID 1984 wrote to memory of 1980	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	99
PID 4212 wrote to memory of 4964	4212	Unicorn-37408.exe	100
PID 4212 wrote to memory of 4964	4212	Unicorn-37408.exe	100
PID 4212 wrote to memory of 4964	4212	Unicorn-37408.exe	100
PID 4468 wrote to memory of 4404	4468	Unicorn-33084.exe	102
PID 4468 wrote to memory of 4404	4468	Unicorn-33084.exe	102
PID 4468 wrote to memory of 4404	4468	Unicorn-33084.exe	102
PID 1452 wrote to memory of 3924	1452	Unicorn-8949.exe	106
PID 1452 wrote to memory of 3924	1452	Unicorn-8949.exe	106
PID 1452 wrote to memory of 3924	1452	Unicorn-8949.exe	106
PID 4964 wrote to memory of 4188	4964	Unicorn-1336.exe	107
PID 4964 wrote to memory of 4188	4964	Unicorn-1336.exe	107
PID 4964 wrote to memory of 4188	4964	Unicorn-1336.exe	107
PID 1980 wrote to memory of 4392	1980	Unicorn-15071.exe	108
PID 1980 wrote to memory of 4392	1980	Unicorn-15071.exe	108
PID 1980 wrote to memory of 4392	1980	Unicorn-15071.exe	108
PID 1984 wrote to memory of 4992	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	109
PID 1984 wrote to memory of 4992	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	109
PID 1984 wrote to memory of 4992	1984	38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe	109
PID 2596 wrote to memory of 1912	2596	Unicorn-18140.exe	111
PID 2596 wrote to memory of 1912	2596	Unicorn-18140.exe	111
PID 2596 wrote to memory of 1912	2596	Unicorn-18140.exe	111
PID 4212 wrote to memory of 5040	4212	Unicorn-37408.exe	110
PID 4212 wrote to memory of 5040	4212	Unicorn-37408.exe	110
PID 4212 wrote to memory of 5040	4212	Unicorn-37408.exe	110
PID 4468 wrote to memory of 2404	4468	Unicorn-33084.exe	112
PID 4468 wrote to memory of 2404	4468	Unicorn-33084.exe	112
PID 4468 wrote to memory of 2404	4468	Unicorn-33084.exe	112
PID 4188 wrote to memory of 1128	4188	Unicorn-27014.exe	113
PID 4188 wrote to memory of 1128	4188	Unicorn-27014.exe	113
PID 4188 wrote to memory of 1128	4188	Unicorn-27014.exe	113
PID 4964 wrote to memory of 4296	4964	Unicorn-1336.exe	114
PID 4964 wrote to memory of 4296	4964	Unicorn-1336.exe	114
PID 4964 wrote to memory of 4296	4964	Unicorn-1336.exe	114
PID 3924 wrote to memory of 2804	3924	Unicorn-27014.exe	115
PID 3924 wrote to memory of 2804	3924	Unicorn-27014.exe	115
PID 3924 wrote to memory of 2804	3924	Unicorn-27014.exe	115
PID 1912 wrote to memory of 2484	1912	Unicorn-25622.exe	116
PID 1912 wrote to memory of 2484	1912	Unicorn-25622.exe	116
PID 1912 wrote to memory of 2484	1912	Unicorn-25622.exe	116
PID 1452 wrote to memory of 1928	1452	Unicorn-8949.exe	117
PID 1452 wrote to memory of 1928	1452	Unicorn-8949.exe	117
PID 1452 wrote to memory of 1928	1452	Unicorn-8949.exe	117
PID 5040 wrote to memory of 4852	5040	Unicorn-39358.exe	118
PID 5040 wrote to memory of 4852	5040	Unicorn-39358.exe	118
PID 5040 wrote to memory of 4852	5040	Unicorn-39358.exe	118
PID 2596 wrote to memory of 1460	2596	Unicorn-18140.exe	119
PID 2596 wrote to memory of 1460	2596	Unicorn-18140.exe	119
PID 2596 wrote to memory of 1460	2596	Unicorn-18140.exe	119
PID 4992 wrote to memory of 4356	4992	Unicorn-106.exe	121

C:\Users\Admin\AppData\Local\Temp\38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe
"C:\Users\Admin\AppData\Local\Temp\38f4f590db7e1f6469654ce05e3ce96a8e5ef36210470ebdd80b75007ac572fd.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37408.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37408.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33594.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        8⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34684.exe
        9⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        10⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        10⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        10⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        10⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        9⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        9⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        9⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        9⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        9⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        9⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        9⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        9⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        9⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        9⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        8⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        8⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34684.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        9⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        9⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
        9⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        9⤵
        
        PID:17880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        9⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        8⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        8⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5524.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17812.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exe
        7⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41482.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        9⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        9⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        9⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        9⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        8⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        8⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13438.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        8⤵
        
        PID:17636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        8⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        7⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        6⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        8⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        8⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        8⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        7⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9607.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        7⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37315.exe
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        6⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40688.exe
        8⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        9⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        9⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        9⤵
        
        PID:17676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        8⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51164.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        7⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        7⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        7⤵
        
        PID:17508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        7⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        6⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39910.exe
        8⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        8⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        8⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        8⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        7⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        7⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        7⤵
        
        PID:17684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        7⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        6⤵
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        6⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        6⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        7⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        6⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        5⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        5⤵
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17047.exe
        5⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
        5⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        9⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        9⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        9⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42458.exe
        9⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        8⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        8⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10682.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        8⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        8⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        7⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        7⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        7⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        7⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49010.exe
        6⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46977.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4715.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-880.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        8⤵
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        8⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        7⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        7⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7870.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
        7⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        6⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        7⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        7⤵
        
        PID:17780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        7⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
        6⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        6⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:17668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
        5⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        8⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        8⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe
        7⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        7⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        7⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        7⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
        6⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        6⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23703.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        6⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        6⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60521.exe
        5⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        5⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        5⤵
        
        PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1761.exe
        7⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        6⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        6⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        6⤵
        
        PID:17728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55233.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        5⤵
        
        PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46608.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        5⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        5⤵
        
        PID:17992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        5⤵
        
        PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
      4⤵
      PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        5⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        5⤵
        
        PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
      4⤵
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
      4⤵
      PID:17260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        9⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        9⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        9⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        9⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        9⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
        8⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17376.exe
        8⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        8⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        7⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        7⤵
        
        PID:17596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6365.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        8⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1185.exe
        8⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        8⤵
        
        PID:18296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19800.exe
        7⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        7⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56811.exe
        7⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5191.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        7⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7532.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        6⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        8⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        8⤵
        
        PID:17440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50615.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        7⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        7⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        7⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        6⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
        6⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22982.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45125.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58554.exe
        8⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        8⤵
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64519.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        7⤵
        
        PID:16940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        6⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        6⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exe
        6⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7838.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        5⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exe
        5⤵
        
        PID:17760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        7⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        7⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        7⤵
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        7⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24200.exe
        6⤵
        
        PID:16932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        6⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        7⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        7⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        7⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        6⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        5⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        6⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        7⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33193.exe
        7⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24574.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        5⤵
        Executes dropped EXE
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        7⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        7⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        6⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        6⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9748.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        6⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        6⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
        5⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        5⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35748.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        5⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        5⤵
        
        PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
      4⤵
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20627.exe
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
      4⤵
      PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      4⤵
      PID:17428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
      4⤵
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        7⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        7⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        7⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        6⤵
        
        PID:17132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        5⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        7⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17798.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        6⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        5⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60693.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
        7⤵
        
        PID:17844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        7⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        6⤵
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        6⤵
        
        PID:17692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19477.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        5⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        6⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        5⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        5⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        5⤵
        
        PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
      4⤵
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32636.exe
      4⤵
      PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
      4⤵
      PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16310.exe
      4⤵
      PID:8744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        5⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        7⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        7⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        6⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        5⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
      4⤵
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        6⤵
        
        PID:16532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16532 -s 212
        7⤵
        Program crash
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        5⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
      4⤵
      PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        5⤵
        
        PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
      4⤵
      PID:13180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
      4⤵
      PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9491.exe
      4⤵
      PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
      4⤵
      PID:8844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      4⤵
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        6⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21388.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        5⤵
        
        PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      4⤵
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
        5⤵
        
        PID:16504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
      4⤵
      PID:16620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38358.exe
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        5⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        5⤵
        
        PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
      4⤵
      PID:13224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
      4⤵
      PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
    3⤵
    PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
      4⤵
      PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
      4⤵
      PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
      4⤵
      PID:17488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
      4⤵
      PID:10060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
    3⤵
    PID:9380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
    3⤵
    PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
    3⤵
    PID:15688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
    3⤵
    PID:9648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 468
      4⤵
      Program crash
      PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56920.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14559.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        7⤵
        
        PID:17232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        7⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62151.exe
        6⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51042.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        5⤵
        
        PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20974.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        6⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        5⤵
        
        PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
      4⤵
      PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        5⤵
        
        PID:512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
      4⤵
      PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
      4⤵
      PID:14732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
      4⤵
      PID:16828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62006.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        6⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        6⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        5⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        5⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        5⤵
        
        PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
      4⤵
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
      4⤵
      PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
      4⤵
      PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26132.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        5⤵
        
        PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10682.exe
      4⤵
      PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
      4⤵
      PID:13892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46574.exe
      4⤵
      PID:17288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
      4⤵
      PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
      4⤵
      PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
      4⤵
      PID:17180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
    3⤵
    PID:7908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
    3⤵
    PID:10536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24820.exe
    3⤵
    PID:13944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
    3⤵
    PID:16556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        6⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39152.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
        8⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30393.exe
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        8⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe
        7⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18420.exe
        7⤵
        
        PID:17572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        7⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        6⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        6⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe
        5⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32982.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        7⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
        7⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        6⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42600.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25136.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        6⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        5⤵
        
        PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        5⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        7⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        7⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21540.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33911.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        6⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64979.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        6⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        6⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        5⤵
        
        PID:17768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
      4⤵
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17366.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe
        5⤵
        
        PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1613.exe
        5⤵
        
        PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
      4⤵
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exe
      4⤵
      PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      4⤵
      PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
      4⤵
      PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        7⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        7⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59244.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:17472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        6⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        5⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
        5⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        5⤵
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        5⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      4⤵
      PID:13056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
      4⤵
      PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
      4⤵
      PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        6⤵
        
        PID:17580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        6⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        5⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        5⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        5⤵
        
        PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        5⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        5⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        5⤵
        
        PID:9784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
      4⤵
      PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
      4⤵
      PID:12988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
      4⤵
      PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exe
      4⤵
      PID:8452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        5⤵
        
        PID:17716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        5⤵
        
        PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
      4⤵
      PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
      4⤵
      PID:6464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37322.exe
    3⤵
    PID:12928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
    3⤵
    PID:16064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        5⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        8⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18420.exe
        7⤵
        
        PID:17900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15957.exe
        6⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
        6⤵
        
        PID:17656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        6⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        5⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        5⤵
        
        PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        6⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        5⤵
        
        PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43994.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        5⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        5⤵
        
        PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
      4⤵
      PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36791.exe
      4⤵
      PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
      4⤵
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:17624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
        6⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35124.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        5⤵
        
        PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33073.exe
      4⤵
      PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
      4⤵
      PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
      4⤵
      PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
    3⤵
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
      4⤵
      PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-880.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        5⤵
        
        PID:17788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1613.exe
        5⤵
        
        PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
      4⤵
      PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
      4⤵
      PID:16840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
      4⤵
      PID:12076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
      4⤵
      PID:17512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
      4⤵
      PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
    3⤵
    PID:9408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
    3⤵
    PID:13012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
    3⤵
    PID:16400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-649.exe
    3⤵
    PID:7612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13589.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13589.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe
        6⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        5⤵
        
        PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
      4⤵
      PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
      4⤵
      PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
      4⤵
      PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
      4⤵
      PID:8596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
    3⤵
    PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39152.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        5⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        5⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe
        5⤵
        
        PID:18088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
      4⤵
      PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
      4⤵
      PID:13976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
      4⤵
      PID:17648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
      4⤵
      PID:16596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
    3⤵
    PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
      4⤵
      PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39696.exe
      4⤵
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1107.exe
      4⤵
      PID:10772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe
      4⤵
      PID:8256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
    3⤵
    PID:8344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
    3⤵
    PID:11500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
    3⤵
    PID:15136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
    3⤵
    PID:17524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
    3⤵
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exe
      4⤵
      PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39884.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
      4⤵
      PID:12536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
      4⤵
      PID:17564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
      4⤵
      PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
    3⤵
    PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
      4⤵
      PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51311.exe
      4⤵
      PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
    3⤵
    PID:9952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
    3⤵
    PID:32
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
    3⤵
    PID:16628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
    3⤵
    PID:18236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23569.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23569.exe
  2⤵
  PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
    3⤵
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
      4⤵
      PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
      4⤵
      PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
      4⤵
      PID:7008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
    3⤵
    PID:9924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
    3⤵
    PID:12744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
    3⤵
    PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
  2⤵
  PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
    3⤵
    PID:11928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
    3⤵
    PID:14200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
    3⤵
    PID:17852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
    3⤵
    PID:9936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
  2⤵
  PID:9416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
  2⤵
  PID:12912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
  2⤵
  PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4404 -ip 4404
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 16532 -ip 16532
1⤵
PID:16552

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe

Filesize
184KB

MD5
6e7aa6978d38eaf30cbbff668e300ef3

SHA1
101a2dac788264ed2b9f32276c55b980f6fffbc3

SHA256
c89f2ea79cd7120976625ed3f7e142f57b34eb2f5f06c53cd1858903726530ed

SHA512
8954ac0f62c5082677a5e876e87fbb2e3a78aa9e6662336ee8e808c30e7d53539b26f3f04d6f580b03e3be310c26b5cbdd0fd8733a22428fdb317d378bb1f355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe

Filesize
184KB

MD5
a8fbd5e2da96657bf75e3cec0631650a

SHA1
dbf1db283ecf5bbfc2014631889cbe19e9f9af1c

SHA256
e3f1969f0079e0ea31e1cb9f45255daacd2694b7a9d97a42166fa93247405967

SHA512
7118ba8ee4d0ba0b7385b824d51c372af0e1c1fa3146fde436b4e7a5fe053e5cf3275a2e33be5e7d3d4aaa38920b021f959a759efc5ea9aee361da8b5923b809

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe

Filesize
184KB

MD5
fbe1ab5c2bd7bc116167f57f3dfb5d4a

SHA1
121a6313956c892d6cf0b772a8f5e5afd776e1d9

SHA256
41cb9e9d7903ad9b8594e07bf7163c2dd1195645286a895faa4bd6ce2e20f2cf

SHA512
0d618c68ca8b44c67657b77b4280a7655493fbe3239f0b24908a5f23f787e269c972d26985d83df53857fc22f78de80498967de8e4da6708b96f3eec4e2e3e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13589.exe

Filesize
184KB

MD5
ad1903669a474726b2a4205d77185be0

SHA1
b0f683e7c872920ff5bd0bf2a11e65ae2cad404b

SHA256
e89caae132c0a617e7b62cc3f8106c2728b435b1547703a5906e64787c453f42

SHA512
3563f3e997b49d9b0b8fb93cbe8d93a021b1691e775f6c3c2891172480c9ccfd7f16d14158527e9a269a6b66dd787a2378953d4c9915b78bf0be88ee1ab5e3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe

Filesize
184KB

MD5
d72879a0e16dfdb6f14e8284798dc03b

SHA1
5bbcdf7b6340d76ef4a24a3cd50e2a2cc6381394

SHA256
de4ea089eb6d627631733f8f44944109db3274fca999d7ec9b0bc4505ff28eb0

SHA512
77055e0273f9d7f30295cfd858cd4bd6494b672f31c77a4b98a777a75b427210d473450bed7897139431542d68de024406d694f78e265da6cf9de32a19c81e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe

Filesize
184KB

MD5
33ea007bf56cdb6df10ba0f437ebc493

SHA1
9813ee4681ffbd936dfa156153d9b3167ea2bf2e

SHA256
35569d315303d3c89fc20f3ccace451769fd8365dc57cb206e47820122a3c82a

SHA512
a56c7d5a6116d6dd541d2d5bd7a4d78c39f221c83f6c185b48345545d25ebe53255fdf8a1112e92f37aec0453037b25e609106d69a5cf11b7e4a9d00947f94b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe

Filesize
184KB

MD5
06f77941fc306eef3e124878f1fd7e0b

SHA1
b123bebf414797ca01e49cb67e6d12fa3487a866

SHA256
1703fcfbab45f347bb058b84eed5b64dcd6546e6ef2d658cda25b28f84decec0

SHA512
3594f0fca03ba23fb1b0a7edf935ffa0c129586503c0b4eedd5d3e8897a6ad4dd70fabb49740d96f16ecb0682bcb4b3a53cf150d0645be795b8b9d4ed953feb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe

Filesize
184KB

MD5
00383acf3c201ed7a9b3703a3cb589e5

SHA1
753c98596555b8fca89ec9e245871cad2d227cc1

SHA256
3aba3734eda84fb6163c89b656b144179d372fc41e3139629ffba59be990babe

SHA512
ff9e428fdbf302973b82c0dbe3b45997f54a94243ab03d8aa80502bd6f85b31ed365163bc8b1cba3528a8be39dbab032042e9c96e9c35e6267b8c945f4bf5f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe

Filesize
184KB

MD5
67a04ff56ee4bc4ac2c2791182cf5dde

SHA1
a019173ba0f2146b44d5d43100276916e655504b

SHA256
5b1a2bf349a32066951610f5992278ca5c473dd5a7d9612cff8f50f778f4520f

SHA512
65538dbf8d829708449620ca863f981ab429f0836778bd8d132afd1a7d6391f1938c3684977f2c0e9ecff4d1d45046f35f68e91b7bf3b509ff1e9b5305f7b11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe

Filesize
184KB

MD5
886e520aac47f5a613bc925c3a374636

SHA1
fcb23e0c5fa5e1830ccd53a68dc89adea285eddc

SHA256
0d689e95474bc10293d24bf9ecd52e74dcb6edbd0b5f58b71e2caecc4b568f33

SHA512
71c4dc6f4813c1dbfba984d52e21e6437496e14b1d6bb1e67d49db075964473e20b3ddb1b090805d62a1c690d0f32c1ba31254b16c11e092c1503833cddd5d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22982.exe

Filesize
184KB

MD5
6fe7eae6e5e5e929841436c7db8cbe26

SHA1
45b4d9e0ec421aa03b6221f5f28355c4d3a0adb6

SHA256
0bc53ec75a0091c3d8137f93753245631f87465af4ec33fc1a61f32269ff7097

SHA512
06fe507e178fa0a24d014438f6e29b31adc76c7c8c9a48cd9a905063d1c47c316911a3b7510842ebfcfeb54dce7789148b7ff6a3258110bf5d6b6e4959b41a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe

Filesize
184KB

MD5
bd1b9616a9916930ff07202eccb887e7

SHA1
0240d52d3744755d0bac99da0858ef8d7aae432e

SHA256
ac04dd8ba5d9fc37706ac22d5380dbbb2bb286ad2be49a026c92635a443b8dcc

SHA512
ab8a4207bb3fd1f033eb46d1130af7acb0c70ed45247ed17fe73312225d292321fc445182981531b8d58ffe0828fdf47d479f4fec3b22623ab939133a13ac855

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe

Filesize
184KB

MD5
252f11722584cd7ce6540de1b5047bc3

SHA1
fa907ccfb69d496c4f0633d359ce7f1129b9d54e

SHA256
da7c623298ff5b312cdfd166013da69a1a3ad43f9e63bbacb0d708554da57483

SHA512
495f2e967f249771be3873d033cb6365ff16b74e4e848193064774ffcd95180943ec6f1dd4ec0a31e1406bc2a55897998b804669df12020d23bdb47f69f6861e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe

Filesize
184KB

MD5
69ce39f7bad72d96a53784e24bb665ca

SHA1
a7503f088b5910cda70a5d7ca35f956050bc2cb6

SHA256
417b8cccf6aebdc08e675a0aa86af97fd7b99fc9becd8fcd94373ae9f5a612dd

SHA512
8d94ec273a538c696b06f96bc4d1d3e5d16c87db7953ab5bebc62190cfb7e6caeedebe3cf1d2867cb6440386675b3299a59c546e51cdbd5fd70a57178be0bbd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe

Filesize
184KB

MD5
7e0a34a1a5a9ea31617b4952d20930fd

SHA1
192fd555e6ad5cc37ae9dc0bb5d3b3b50b55567a

SHA256
105a3057cde080100f543e010e74f0ae001f05aac3b865d3b1a2d175bfbc6df1

SHA512
4751590b1b69f579190f511dc99b8202cba34b163eae1f7601b2d69ede04305c75d23c9b8534156d53f1b17e1a427129ed4d3edb6858a30d325ebadb532f25da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe

Filesize
184KB

MD5
a33a81b8209a7bbad076b9e49aa5a087

SHA1
e5c64fe30b3de596038a40a0105c9088f8a5b9f6

SHA256
71137c1b5581d3eee770d4ad2f33e989c18fa61e5ce91c9df8193c72caa6601a

SHA512
489078fe51b37cfa902f8c118eeff4be141348a9ced4a8a5f6739a45aadceae3aec7d7d02c3f8af49e84c77221d55a72d63f0aa01beca3ea15c354d9993a3749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe

Filesize
184KB

MD5
dab7a60ec34d50795e5e048326337168

SHA1
415e97f184a0670293a429fbdf62e4b2d773bac0

SHA256
dc87d0f8b0aece5b9b08fd5feeb340ab92994e533b6a719f291e3ebc9baf7d7f

SHA512
862706bdc5854d3a2f33dce722a2c45d24863d7de2749804c36dbdc0b948a4d6b615917ae87937c190229f35f11c992b47e82dbc059091808875c8ab3dd5ecce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33594.exe

Filesize
184KB

MD5
08c69a07bc38515b7561491f364cdd89

SHA1
30a189b2b6d395bf153a4b60d798cc1fdcea48a0

SHA256
738c48df5eafadbfad614fbe6b9cfe559c205ac442daf07b2f03e29306f1e29d

SHA512
21607e903dcd06a9f86161de6536ffe723739ae378b3240a4047ff613dbbc9fac6cd3d89b39b9df8ace8df7e5c26d25b70aae5a7f6903f441079803db3180b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe

Filesize
184KB

MD5
ca4b503be60e3de467d5b5f7451b1613

SHA1
68621b2bb194c541c37641c771c19e93384bd269

SHA256
c5460331a0f9cf62633afa91a3959f1a7ddd5d0de1751a768cc643dbd87e4925

SHA512
a93fc1f87a1710190c9830e2868be69ffb7153e4b90a130c174072040c180eb5da3ee4a2408703addacd4e566d0096c164b7b6417dff8cf5c2aa2bcb29c831ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37408.exe

Filesize
184KB

MD5
5294777269b0145d1f8f82c6b61aa177

SHA1
92277fbcfd4261f59f82f6bacefe0aa702843869

SHA256
ba66d963fc725da3cb714e7cfc901b36e45b10b6d86727655e94cc04918e3402

SHA512
00868f1d12f9925761581fc7623c9f21434d40ca932787aa7763376870bc006e316e961252a8a80b74b5f91d3fe4fedf55c0508c5675871bf0bbe776de6a7977

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe

Filesize
184KB

MD5
2123bfbe9acd9ee6b6dcbabe53f896bb

SHA1
951c68d6c1b769f0ca3cca45232ee88215207ac1

SHA256
e6328937ce9a6189c2ce09c749a2cf4024f6a2ba272dcec2e37c4661f6b9337a

SHA512
b42a87a6cdd6e77b26d619b72f9c705c8ed890e6bf6970886dbbb2aa85eff81e02f4b89f39b1d08fbba2f534104780e740eaf7fdcf2adb39b1d31a4e100ec55b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe

Filesize
184KB

MD5
ac08b158a48b54625e9803464ab2bbc9

SHA1
785de5cfa47229917ec64e2301c5bdacbae5f479

SHA256
52bf41518df476e06a20dd7d96348005c945608a57770a30feec4999c6b48a95

SHA512
787abac77e17812751d126be78c34fcf33177557d4781c1612613330c6a6c8f6e8959da776ed58bf9623239915c768c989d18aa6eab73672f2d66ba89369d148

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe

Filesize
184KB

MD5
7d4279d6234878430978f5e94c09d989

SHA1
9d939ecc417f0e833a1ecc2017aa7fd1cc1189bc

SHA256
5abda855f31dcf3aa8c112d0831a7babb43672e16c7a761e4b4bbeaa4b79c893

SHA512
3282e45d4e491d134d5c8949d29eb588baf3a0ef2be7e70224c7061e2891dbc681e037e302df5eae7a82b60ca3216291654adeaf5c3917a415eb11a8f8b9b24a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe

Filesize
184KB

MD5
64e2098486deb1039e819eedc0e0c3d0

SHA1
e1c794c487ec3a0265c442156635ede622572b61

SHA256
db43f3624bbd2e147581ef425797fcaeccf75b00da51387748f1379349e25a60

SHA512
0a29e991624303c2f36678f851a98a5d3fe3312ab6c2b4b27c589ef9e7068def44f3207a40b0ae3614f57f01167f1b6f9c4eb77c95b23face0d7510a95e7ffa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe

Filesize
184KB

MD5
71adf0b82f4db628612c45ce30908429

SHA1
9ac58a48f177d3337190153fb33072494aa69072

SHA256
0f84b1dd6e32596b20882ebf42b0467407caafb73d00a8d9d86dbdebb121a4b2

SHA512
006fd1cfbfdd50be5ac582b541235c6d367e000d4508eaf07842b8abe2ab6414c6102b859145395cdd26e419776d5756acc20c63d513dbb5b0a127e9fd7e980e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe

Filesize
184KB

MD5
aa03087f149000873b8bb37d68ebef28

SHA1
b6e6a7c2d842a998244571af6621ebfb84264270

SHA256
661932fb4a6d1f1bc9d6635df503baee8f90cd7bf71e15cd273d01b47235c692

SHA512
93f4d3b44093b7af0e86f3911cd36aec817e2b8ea633a1ff6cc22b489e39051df0c84106c0d14f4d252525f441ea71de58ce3295e525c9b2579b152271e29b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe

Filesize
184KB

MD5
c8932fe71a9942972b7ecd51911c7bba

SHA1
8d7d55e055babb45b8c9035d532844b11b69782f

SHA256
e33fc9d20afad6076665786602316a78b942a473abe1dbfefe05cc73af775df1

SHA512
c2d6422bd0d3878f776bd318d0199c2d5aae586897ef36443db1aa3198d902482c33c712a22003bcd260d72e61d4659268ce203dc5e927308fb4d6c0749e4eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe

Filesize
184KB

MD5
58f04afeaf862e458d44bea30ad73116

SHA1
fd457ebe1c32300b3df791cc68096f3646e0117c

SHA256
d29e9040cf1ef69aa94ea08c52d239a43b6cf7bfc8818e200c88a5f590d7022e

SHA512
007c912bd7f677efaf10e067918e84f936da069793954dafe552e71c0a048c678fe9349555012727cb0bc41f9e038347e964f811acec81ed11f3aef8c0f6ead9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe

Filesize
184KB

MD5
9943205b8882d4fd15478cdb3be498e5

SHA1
d66e78de793fd538bee8d828a3301a6f922952ee

SHA256
b094c22c4af12d944dc2a2a80765098ddd15fd8f65b8d557f9ba605c000dde6f

SHA512
02a32f37609568550c75b1633e0688d965b2c601bb12ee6944f57cd3f489024412d887ff101189004f7b3858049529a4a6ea66bc6c539b14b2e7c12f310cca7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe

Filesize
184KB

MD5
48ec49252493079dd925b354fa66d07b

SHA1
d9c60026c6cd2e38cef72e6ad36cea20044be7f9

SHA256
695cb132e5d9fb545d1aa1ebe7201d01ce23c52b7049bd1709b50e2180deac23

SHA512
4dfeadd1605a9b0d431c043a0749e37f08ecd7ed8fe1f2293561e0476d0097cef67aa98406ac2b98e5b6e0ea429dfd6c7027621606c20f7b5a1bbce86ba5c05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe

Filesize
184KB

MD5
a9c72a2f4ca5d562bcf7593b011ab16d

SHA1
c7f8e879ea6c024dd965f4549284bc1a7a0b3555

SHA256
1a4ab7434fd81fbc91c04e7f2dbc5eea58c608d8085484d7576f74ed33fd68e1

SHA512
93e5fbdb122c2a0e82d6770ade597627fa55b4223e24d818dc4ea48abe7c1213a5f1ac2b99affb6bcaa32185e65be09a34a195b58c640ddf029f7c1532a381c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe

Filesize
184KB

MD5
ed33451517a2cdb8d3aa760a5f7f57a5

SHA1
115f2c141a062c5be22cfed3ac2b649777080f06

SHA256
0d0eb0acff262590e66d7729edcbccf9518f09b0d3eef4f6a2f723d11bb61898

SHA512
25bc8afc7f8b19dd97e00dcdbcdb3e1599add743b0aca906b317b3f66f456b389acca57003011f343996b3db2e42e791153f4cac9eae7750d745f5c69bc96ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe

Filesize
184KB

MD5
0bf5d10fc72e5389aad4e2d90f52e9c7

SHA1
03a3299dd45cdc2015aa492af4d3043e4546cccb

SHA256
fdeb28f183d244d4945d30906b2044e93d138312921049f78ea3c2f1d744d9b2

SHA512
bfdb16c8855f58d7a1981fa46020b54e2e138fab0646b9649c0f77601e585e5775b0a61b6bae23f6fb77b5989bed21386983ce23fc1ef236429ef0b1793b61a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe

Filesize
184KB

MD5
c8b3265b7ca034569cf210f9ca1e5488

SHA1
7019a620bc4e53ac409ad8c033c619c25e530647

SHA256
76cedce65e74c6cde4a185a639c30546d3c07467678b2936b4c18048bea0f730

SHA512
7d887308ead4c57dffc312b1543c5d4b085567f4b1a0b0bd118e92e242b82bdc69ded554cb54db5ec101b00bb868709cc0920460cc3a92b91cdcaa20000db3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe

Filesize
184KB

MD5
43832228f2c859268f7df3eca70a6464

SHA1
b6852f9607986a963d419c73862b3b0be67f0a08

SHA256
62f6c34a9741b5e920b8ea31216a5e8e942a6f6d1768ffefbcc822dde43a26dd

SHA512
1f167aa033c020139559dd979c9b76d80e4989af61a413af499388926dc9151d81e784e7e7f570f877a300e07859a7dfaeca94abf95a4bf8229a751c5cd0b625

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe

Filesize
184KB

MD5
51c17d4e5b2832ed85a4b37e8c041184

SHA1
f2b682bdae8d5aab0ddd0544d5ef7b0808ccf11e

SHA256
be304d7dc3ab17ac3031422fd26712a70295e6356d1827070e8e8e903dbe537c

SHA512
f557bb2b65f331e7515557f39d29442786381c7ecc7a901ad70e2ad506444a2d0fd433fde60152983dd0550ff230dcec4f15477ee9d3ae771db7024c108c845b

Download Submit
memory/1128-2919-0x00007FFE4D8D0000-0x00007FFE4D953000-memory.dmp

Filesize
524KB

Download
memory/13684-3573-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads