17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe
Size

184KB
MD5

08a0aee8fb5fbc32df262bc38e02df80
SHA1

724e603196ddef6703335b87ef13ca1bc1863c42
SHA256

17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac
SHA512

9004ffd238e89b4bc58e3e9ac8f49f83d0946400a3bbc2535bd9c2f3886cf07bce24af03856bcfac1f21ff1be023ab5e30c4ea5c040e99bce47d1cd03e47e402
SSDEEP

3072:CxRrrAonEQiI2tqtWaAwbSlHlvnqnniGG:Cx2o+vtqIwWlHlPqnniG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3796	Unicorn-17162.exe
4612	Unicorn-39523.exe
836	Unicorn-45890.exe
5092	Unicorn-4297.exe
4940	Unicorn-58651.exe
4424	Unicorn-52521.exe
2308	Unicorn-46954.exe
2628	Unicorn-54946.exe
4964	Unicorn-54946.exe
712	Unicorn-15729.exe
4220	Unicorn-52123.exe
3960	Unicorn-51858.exe
5076	Unicorn-40425.exe
1896	Unicorn-60291.exe
2916	Unicorn-21488.exe
1300	Unicorn-11002.exe
788	Unicorn-24001.exe
1512	Unicorn-21667.exe
2364	Unicorn-34665.exe
1700	Unicorn-53187.exe
5036	Unicorn-20515.exe
4060	Unicorn-45211.exe
1504	Unicorn-39081.exe
5068	Unicorn-53379.exe
2280	Unicorn-25537.exe
1368	Unicorn-39273.exe
868	Unicorn-12465.exe
5040	Unicorn-45403.exe
3328	Unicorn-36472.exe
3864	Unicorn-25537.exe
4752	Unicorn-44547.exe
1076	Unicorn-177.exe
1328	Unicorn-46275.exe
1476	Unicorn-43352.exe
4672	Unicorn-17665.exe
4808	Unicorn-13026.exe
2080	Unicorn-21579.exe
4244	Unicorn-22984.exe
1200	Unicorn-52834.exe
3068	Unicorn-33896.exe
4824	Unicorn-40603.exe
3920	Unicorn-53602.exe
448	Unicorn-51978.exe
2460	Unicorn-12761.exe
4644	Unicorn-43810.exe
2532	Unicorn-52170.exe
4388	Unicorn-16291.exe
3184	Unicorn-43737.exe
3528	Unicorn-44002.exe
928	Unicorn-56554.exe
2892	Unicorn-2393.exe
2688	Unicorn-52362.exe
812	Unicorn-18729.exe
2236	Unicorn-35672.exe
536	Unicorn-7552.exe
4316	Unicorn-33369.exe
2200	Unicorn-27503.exe
396	Unicorn-6498.exe
1600	Unicorn-12808.exe
5116	Unicorn-13322.exe
3816	Unicorn-15552.exe
4376	Unicorn-62715.exe
1256	Unicorn-13192.exe
4868	Unicorn-41226.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3832	2364	WerFault.exe	113
7428	6084	WerFault.exe
10624	7740	WerFault.exe	306
1376	19060	WerFault.exe
18396	7288	WerFault.exe	320
13472	7444	Process not Found	338
8632	9844	Process not Found	1112

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18108	dwm.exe
Token: SeChangeNotifyPrivilege	18108	dwm.exe
Token: 33	18108	dwm.exe
Token: SeIncBasePriorityPrivilege	18108	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe
3796	Unicorn-17162.exe
836	Unicorn-45890.exe
4612	Unicorn-39523.exe
4940	Unicorn-58651.exe
5092	Unicorn-4297.exe
4424	Unicorn-52521.exe
2308	Unicorn-46954.exe
2628	Unicorn-54946.exe
4964	Unicorn-54946.exe
712	Unicorn-15729.exe
1896	Unicorn-60291.exe
5076	Unicorn-40425.exe
4220	Unicorn-52123.exe
3960	Unicorn-51858.exe
2916	Unicorn-21488.exe
1300	Unicorn-11002.exe
788	Unicorn-24001.exe
1512	Unicorn-21667.exe
2364	Unicorn-34665.exe
1700	Unicorn-53187.exe
5036	Unicorn-20515.exe
4060	Unicorn-45211.exe
5068	Unicorn-53379.exe
1504	Unicorn-39081.exe
5040	Unicorn-45403.exe
2280	Unicorn-25537.exe
868	Unicorn-12465.exe
3328	Unicorn-36472.exe
1368	Unicorn-39273.exe
3864	Unicorn-25537.exe
4752	Unicorn-44547.exe
1076	Unicorn-177.exe
1476	Unicorn-43352.exe
1328	Unicorn-46275.exe
4672	Unicorn-17665.exe
4808	Unicorn-13026.exe
2080	Unicorn-21579.exe
4244	Unicorn-22984.exe
1200	Unicorn-52834.exe
3068	Unicorn-33896.exe
4824	Unicorn-40603.exe
3920	Unicorn-53602.exe
448	Unicorn-51978.exe
2460	Unicorn-12761.exe
4644	Unicorn-43810.exe
2532	Unicorn-52170.exe
4388	Unicorn-16291.exe
2892	Unicorn-2393.exe
3184	Unicorn-43737.exe
3528	Unicorn-44002.exe
928	Unicorn-56554.exe
2236	Unicorn-35672.exe
536	Unicorn-7552.exe
2688	Unicorn-52362.exe
812	Unicorn-18729.exe
4316	Unicorn-33369.exe
2200	Unicorn-27503.exe
396	Unicorn-6498.exe
1600	Unicorn-12808.exe
5116	Unicorn-13322.exe
3816	Unicorn-15552.exe
4376	Unicorn-62715.exe
1256	Unicorn-13192.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3796	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	90
PID 540 wrote to memory of 3796	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	90
PID 540 wrote to memory of 3796	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	90
PID 3796 wrote to memory of 4612	3796	Unicorn-17162.exe	93
PID 3796 wrote to memory of 4612	3796	Unicorn-17162.exe	93
PID 3796 wrote to memory of 4612	3796	Unicorn-17162.exe	93
PID 540 wrote to memory of 836	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	94
PID 540 wrote to memory of 836	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	94
PID 540 wrote to memory of 836	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	94
PID 836 wrote to memory of 5092	836	Unicorn-45890.exe	96
PID 836 wrote to memory of 5092	836	Unicorn-45890.exe	96
PID 836 wrote to memory of 5092	836	Unicorn-45890.exe	96
PID 4612 wrote to memory of 4940	4612	Unicorn-39523.exe	97
PID 4612 wrote to memory of 4940	4612	Unicorn-39523.exe	97
PID 4612 wrote to memory of 4940	4612	Unicorn-39523.exe	97
PID 540 wrote to memory of 4424	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	98
PID 540 wrote to memory of 4424	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	98
PID 540 wrote to memory of 4424	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	98
PID 3796 wrote to memory of 2308	3796	Unicorn-17162.exe	100
PID 3796 wrote to memory of 2308	3796	Unicorn-17162.exe	100
PID 3796 wrote to memory of 2308	3796	Unicorn-17162.exe	100
PID 5092 wrote to memory of 2628	5092	Unicorn-4297.exe	102
PID 5092 wrote to memory of 2628	5092	Unicorn-4297.exe	102
PID 5092 wrote to memory of 2628	5092	Unicorn-4297.exe	102
PID 4424 wrote to memory of 4964	4424	Unicorn-52521.exe	103
PID 4424 wrote to memory of 4964	4424	Unicorn-52521.exe	103
PID 4424 wrote to memory of 4964	4424	Unicorn-52521.exe	103
PID 836 wrote to memory of 712	836	Unicorn-45890.exe	104
PID 836 wrote to memory of 712	836	Unicorn-45890.exe	104
PID 836 wrote to memory of 712	836	Unicorn-45890.exe	104
PID 4940 wrote to memory of 4220	4940	Unicorn-58651.exe	105
PID 4940 wrote to memory of 4220	4940	Unicorn-58651.exe	105
PID 4940 wrote to memory of 4220	4940	Unicorn-58651.exe	105
PID 540 wrote to memory of 3960	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	106
PID 540 wrote to memory of 3960	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	106
PID 540 wrote to memory of 3960	540	17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe	106
PID 4612 wrote to memory of 5076	4612	Unicorn-39523.exe	107
PID 4612 wrote to memory of 5076	4612	Unicorn-39523.exe	107
PID 4612 wrote to memory of 5076	4612	Unicorn-39523.exe	107
PID 2308 wrote to memory of 1896	2308	Unicorn-46954.exe	108
PID 2308 wrote to memory of 1896	2308	Unicorn-46954.exe	108
PID 2308 wrote to memory of 1896	2308	Unicorn-46954.exe	108
PID 3796 wrote to memory of 2916	3796	Unicorn-17162.exe	109
PID 3796 wrote to memory of 2916	3796	Unicorn-17162.exe	109
PID 3796 wrote to memory of 2916	3796	Unicorn-17162.exe	109
PID 4964 wrote to memory of 1300	4964	Unicorn-54946.exe	110
PID 4964 wrote to memory of 1300	4964	Unicorn-54946.exe	110
PID 4964 wrote to memory of 1300	4964	Unicorn-54946.exe	110
PID 4424 wrote to memory of 788	4424	Unicorn-52521.exe	111
PID 4424 wrote to memory of 788	4424	Unicorn-52521.exe	111
PID 4424 wrote to memory of 788	4424	Unicorn-52521.exe	111
PID 2628 wrote to memory of 1512	2628	Unicorn-54946.exe	112
PID 2628 wrote to memory of 1512	2628	Unicorn-54946.exe	112
PID 2628 wrote to memory of 1512	2628	Unicorn-54946.exe	112
PID 5092 wrote to memory of 2364	5092	Unicorn-4297.exe	113
PID 5092 wrote to memory of 2364	5092	Unicorn-4297.exe	113
PID 5092 wrote to memory of 2364	5092	Unicorn-4297.exe	113
PID 712 wrote to memory of 1700	712	Unicorn-15729.exe	114
PID 712 wrote to memory of 1700	712	Unicorn-15729.exe	114
PID 712 wrote to memory of 1700	712	Unicorn-15729.exe	114
PID 1896 wrote to memory of 5036	1896	Unicorn-60291.exe	115
PID 1896 wrote to memory of 5036	1896	Unicorn-60291.exe	115
PID 1896 wrote to memory of 5036	1896	Unicorn-60291.exe	115
PID 3960 wrote to memory of 4060	3960	Unicorn-51858.exe	117

C:\Users\Admin\AppData\Local\Temp\17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\17a6bb43ffe1bb9dfb82fb5c1a43e4ade062c2a889b485b29123f2459abcd8ac_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39523.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
        7⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        9⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        9⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        9⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14344.exe
        9⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        8⤵
        
        PID:18860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        8⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        9⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        8⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        8⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        6⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        8⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        7⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
        6⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        7⤵
        
        PID:17288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        6⤵
        
        PID:17556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        6⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50803.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        9⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        9⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        9⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        8⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57944.exe
        8⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        8⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        8⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        8⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
        7⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29024.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        6⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24320.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37369.exe
        8⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9920.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49776.exe
        7⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36272.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11991.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27503.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        7⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20959.exe
        7⤵
        
        PID:19288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        5⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        6⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        6⤵
        
        PID:19060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19060 -s 72
        7⤵
        Program crash
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        9⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38969.exe
        9⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        9⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        9⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        8⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        8⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        8⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25345.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10848.exe
        7⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12873.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        8⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41639.exe
        8⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        7⤵
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        7⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32976.exe
        7⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3823.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
        6⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12761.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45193.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        8⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        8⤵
        
        PID:17636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        6⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        6⤵
        
        PID:18192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34200.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        7⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        7⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        7⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
        6⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        6⤵
        
        PID:18712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exe
        5⤵
        
        PID:14384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62618.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
        5⤵
        
        PID:19388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        8⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        8⤵
        
        PID:18260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2241.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
        7⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        7⤵
        
        PID:18836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        7⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        6⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exe
        7⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        7⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
        6⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1914.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        6⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        5⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        5⤵
        
        PID:18388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
        6⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        5⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        6⤵
        
        PID:18296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3977.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
        5⤵
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        5⤵
        
        PID:18204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        5⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        5⤵
        
        PID:19068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
        5⤵
        
        PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        5⤵
        
        PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
      4⤵
      PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
      4⤵
      PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
      4⤵
      PID:15636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        9⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        9⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        9⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        9⤵
        
        PID:18604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        8⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        8⤵
        
        PID:18632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29448.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        8⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe
        8⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        7⤵
        
        PID:18628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        8⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        7⤵
        
        PID:18768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        7⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24665.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exe
        6⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27443.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16674.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        8⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
        7⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        7⤵
        
        PID:18740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        7⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62946.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        7⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54818.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        6⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        6⤵
        
        PID:18828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        6⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
        5⤵
        
        PID:7740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 624
        6⤵
        Program crash
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        5⤵
        
        PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24816.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        7⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        7⤵
        
        PID:18816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        7⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        6⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
        7⤵
        
        PID:19252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        7⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        6⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        6⤵
        
        PID:19220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        6⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        6⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        6⤵
        
        PID:19084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41857.exe
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        5⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        5⤵
        
        PID:18752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        7⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        6⤵
        
        PID:18008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        5⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        6⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        5⤵
        
        PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        6⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        6⤵
        
        PID:19176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        5⤵
        
        PID:12336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        5⤵
        
        PID:18580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        5⤵
        
        PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
      4⤵
      PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        5⤵
        
        PID:17868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
      4⤵
      PID:17240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        7⤵
        
        PID:19076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        7⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        6⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        6⤵
        
        PID:18644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        6⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        6⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36649.exe
        6⤵
        
        PID:18852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        6⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        5⤵
        
        PID:18148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50803.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        7⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        7⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        6⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        6⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        6⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
      4⤵
      PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        5⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
        5⤵
        
        PID:18660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        5⤵
        
        PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
      4⤵
      PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        5⤵
        
        PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        5⤵
        
        PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
      4⤵
      PID:9292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14449.exe
      4⤵
      PID:13012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        5⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        5⤵
        
        PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      4⤵
      PID:13056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13536.exe
      4⤵
      PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
      4⤵
      PID:19232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        5⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
        5⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
        5⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
      4⤵
      PID:9648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
      4⤵
      PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
      4⤵
      PID:18688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
      4⤵
      PID:9780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
    3⤵
    PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
      4⤵
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
        5⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        5⤵
        
        PID:18328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
      4⤵
      PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
      4⤵
      PID:13176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57131.exe
    3⤵
    PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
    3⤵
    PID:10888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
    3⤵
    PID:14728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28168.exe
    3⤵
    PID:14124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4297.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        7⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        9⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        9⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        9⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        9⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        8⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        8⤵
        
        PID:19300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exe
        8⤵
        
        PID:18716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        8⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        8⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25345.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        7⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63611.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        8⤵
        
        PID:19044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27631.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        7⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        7⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        7⤵
        
        PID:18784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        7⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65147.exe
        8⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        9⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        9⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31265.exe
        8⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        7⤵
        
        PID:18252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61393.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        7⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        7⤵
        
        PID:18448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        6⤵
        
        PID:18720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        6⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        7⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        7⤵
        
        PID:18440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        6⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        5⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        5⤵
        
        PID:18124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 720
        5⤵
        Program crash
        
        PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31771.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        7⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        7⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        6⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        6⤵
        
        PID:17864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35375.exe
        6⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        6⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        5⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        5⤵
        
        PID:18696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        5⤵
        
        PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        6⤵
        
        PID:18760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        6⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        5⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe
        5⤵
        
        PID:18540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30694.exe
        5⤵
        
        PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        5⤵
        
        PID:17744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
      4⤵
      PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe
      4⤵
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4520.exe
      4⤵
      PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
      4⤵
      PID:18380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15729.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        8⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        7⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        7⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe
        7⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        7⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61513.exe
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63041.exe
        6⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48529.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        7⤵
        
        PID:18180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43216.exe
        6⤵
        
        PID:17876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21616.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        6⤵
        
        PID:18808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exe
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30482.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        5⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        5⤵
        
        PID:18792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52834.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        8⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        8⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37369.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        7⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        6⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28792.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        6⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        5⤵
        
        PID:18728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        5⤵
        
        PID:18640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        6⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        6⤵
        
        PID:19052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
        6⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        5⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        5⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        5⤵
        
        PID:18776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        5⤵
        
        PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
      4⤵
      PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        5⤵
        
        PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      4⤵
      PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
      4⤵
      PID:17544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        7⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        7⤵
        
        PID:18864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        6⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        6⤵
        
        PID:18872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        6⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        6⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        6⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
        5⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        5⤵
        
        PID:19240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        6⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
      4⤵
      PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
      4⤵
      PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
      4⤵
      PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
      4⤵
      PID:6084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 632
        5⤵
        Program crash
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exe
        5⤵
        
        PID:13072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        5⤵
        
        PID:18128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7760.exe
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
      4⤵
      PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
      4⤵
      PID:17940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
    3⤵
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      4⤵
      PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44378.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25361.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        5⤵
        
        PID:14148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
      4⤵
      PID:12588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
      4⤵
      PID:18676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
      4⤵
      PID:8796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
    3⤵
    PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4689.exe
      4⤵
      PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
      4⤵
      PID:18160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
    3⤵
    PID:10596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
    3⤵
    PID:14424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
    3⤵
    PID:6308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        9⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        9⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35008.exe
        9⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        8⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        8⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        8⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        7⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45193.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13384.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62737.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        6⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54587.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-199.exe
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        8⤵
        
        PID:18568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        7⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        7⤵
        
        PID:19284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        7⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        7⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
        6⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        5⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        5⤵
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
        7⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
        7⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        6⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        7⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        7⤵
        
        PID:17532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        6⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        6⤵
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23729.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9506.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15664.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
        6⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        5⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        6⤵
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        5⤵
        
        PID:17856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15552.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        6⤵
        
        PID:18052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exe
        5⤵
        
        PID:18112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        5⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
      4⤵
      PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
      4⤵
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
        5⤵
        Executes dropped EXE
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41546.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
        7⤵
        
        PID:18556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        6⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        6⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8287.exe
        6⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        5⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        5⤵
        
        PID:18668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        6⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
        7⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        7⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        6⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        6⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        6⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32417.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        5⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
      4⤵
      PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56433.exe
      4⤵
      PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      4⤵
      PID:14484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25903.exe
      4⤵
      PID:18072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40361.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        6⤵
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        5⤵
        
        PID:17920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
      4⤵
      PID:16176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
      4⤵
      PID:19276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
      4⤵
      PID:11996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      4⤵
      PID:18704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
    3⤵
    PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
      4⤵
      PID:7288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 636
        5⤵
        Program crash
        
        PID:18396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      4⤵
      PID:17832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      4⤵
      PID:9844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20688.exe
    3⤵
    PID:8356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
    3⤵
    PID:10500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
    3⤵
    PID:14600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
    3⤵
    PID:6328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        6⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        7⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        7⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37303.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        6⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        5⤵
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
        5⤵
        
        PID:19224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
      4⤵
      PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        5⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
        5⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        5⤵
        
        PID:18096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
      4⤵
      PID:10852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      4⤵
      PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      4⤵
      PID:18404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7392.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        5⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33190.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
      4⤵
      PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        5⤵
        
        PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
      4⤵
      PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
      4⤵
      PID:17796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27568.exe
    3⤵
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        5⤵
        
        PID:13956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
      4⤵
      PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47289.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
      4⤵
      PID:18636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42329.exe
    3⤵
    PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
      4⤵
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
      4⤵
      PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      4⤵
      PID:7900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
    3⤵
    PID:10560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
    3⤵
    PID:9812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        6⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        6⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53170.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
      4⤵
      PID:13092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
      4⤵
      PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
      4⤵
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
      4⤵
      PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      4⤵
      PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35177.exe
    3⤵
    PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
    3⤵
    PID:11804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
    3⤵
    PID:14396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9431.exe
    3⤵
    PID:1276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1247.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
      4⤵
      PID:18428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exe
    3⤵
    PID:7816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
    3⤵
    PID:10960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
    3⤵
    PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
    3⤵
    PID:19180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
  2⤵
  PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
    3⤵
    PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
      4⤵
      PID:11044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe
      4⤵
      PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
      4⤵
      PID:18592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
      4⤵
      PID:7260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
    3⤵
    PID:10696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe
    3⤵
    PID:14976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44962.exe
    3⤵
    PID:5284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
  2⤵
  PID:7584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49824.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49824.exe
  2⤵
  PID:10876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
  2⤵
  PID:11844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
  2⤵
  PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2364 -ip 2364
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6084 -ip 6084
1⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7740 -ip 7740
1⤵
PID:11356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7288 -ip 7288
1⤵
PID:17604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 15912 -ip 15912
1⤵
PID:19228

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7444 -ip 7444
1⤵
PID:14072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe

Filesize
184KB

MD5
cfaed3dd9b457bfdacd31de1e594f4ce

SHA1
92b0a3fcea5a336f4bfc1dc3ae4bc7c74adcd94e

SHA256
dc2bb71c7f6c0c1f94ce86e2518a0e71b1cc0efa65006ecbb0825e7ea5f0a66a

SHA512
26b83f3577ac95f22b7333d314f943cdfc68ba6459b1129397f2577d9635f69bc8d3683f81756178a0f0b258ab0eafe492daac6bdf13509b4252b4f2b2764fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe

Filesize
184KB

MD5
491ba7bdebace4e52430c13d658b6375

SHA1
ca3fe01f5de517bdc42cb1bca449dd4c0b03f12b

SHA256
596a35630fb36388969c4f298b2c6ed72239cd5baabd0ad8cf54d0c74109cb6c

SHA512
63c096b830bd03aaf074860574da131e62c1c85d24623a39b03b0b43975c99a54edb468db34aa6c270c1d35e59c238a62b1315eb0f303e98d8ac1cac092d955d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe

Filesize
184KB

MD5
152616cc0fc98dd5c4008b78d329ebe3

SHA1
f33f5febac80b585ca0cd3518b2673fe61cae1ab

SHA256
dc653dd3ea364be9f0267155ca0708958c76ce52b7bd8e9bd8639465af073cbc

SHA512
9b563e2dc26118c6f5350386768727e1be1713e600c0dd376ea9bdf954d8735e00f3a39438e7d44c5def907d87f9e347fdc85a1e1c1d7ba120880cb66ff4158b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15729.exe

Filesize
184KB

MD5
fc8d129ecee66b06b704190985e66ab3

SHA1
dade10d09c01c16460e169426a3fe8a00d002d50

SHA256
fc9299b2dd6e3c1f7ca616cd6e116d8015fa88acd58447c11b2d537271acd966

SHA512
0e7da3bffc09337ca95139ec1aa04988b57e881d0f727832dac8373865b1d8328b40d5de49215de2845a0d2abdb1c805414dc1842a21fcfdc790c45c61524aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe

Filesize
184KB

MD5
b3a3c0e4e7fe97ecde453ab168759f8c

SHA1
003ff4b55c3fd49578e2bbb2a2059c282b78601e

SHA256
aa2fa1739c5bca43186ae92e7a578dfabe746e5afa0e024bc8a1e4d86c07cf80

SHA512
9d257801f5cf581d07f1cd02cad1b32251641a0f599a8e742f9452215aa1834aa749fce91bc396b90427fac46c3e0deb7b7366e5f18df3c526f0c6f47c0c5db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe

Filesize
184KB

MD5
eac7138520f9b3fba191754913b3fcca

SHA1
035c38c89fcd49d575591bf0dbc944d2b316a36b

SHA256
caaeb0a8a367cb86ded4ec36dff33d91050483819fd6b4e2a26f6231b9d41c19

SHA512
d2fbfa9ee8c39e00949e5c724ce1f57acea1c2b553484481fc3ceb049f5e683593731991a6c43ac22525e8e55acdec2d599606d26c48ba2777b61c377e2f46ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe

Filesize
184KB

MD5
f71a17afe0954e1d7f6c87699f7eecd4

SHA1
a56e2fb4ab291adc3d918f1c8cfa98b9692d8e55

SHA256
77738694f1898d44858b34e350c20f5280f003e8b2b1db20aefe9b4addc3b39c

SHA512
95a60db0da543f90e26eb22835bd9f90ab1a3e4cec641c0f57fa08979de80cb2ec18f162d142821045424c36c231b1b6998e2e1d062234e045f129dfadb0a1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe

Filesize
184KB

MD5
68d4129d13648d339f6a14242ba8abdd

SHA1
2450099dabb7175e20bede8765cec4c1e59ffec0

SHA256
405b936e659307dd57966f10c50ba6dedeee0c480faf6cc9d1ee5fd5e5858e9d

SHA512
4be57850d958f6e8956998b8cc9782dee4219f5c60c8274062d280fdaf41d0f8594449db84b5307d533589082d0438490ae10bca18e785c646f52b381d836650

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe

Filesize
184KB

MD5
bb08c3d65e8089b25abc445c12e3bb08

SHA1
ee72fe9e626835fa347d25730a437c6502bd7800

SHA256
2d57f16bcf7b00f1315cfe5d9bfb0486982265a2d43edcb341d12c6d799af8d2

SHA512
9ffafefa219bb04e36c6dda5da82f4934967a328578249a396df94f059c69e30e02c5b8e0fdf9d92b8aeb268c0c15e990bc94143d7b6e85760169d71f0850db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe

Filesize
184KB

MD5
0db606926bb8080a62d1e7295089d5c5

SHA1
db673b1889f3e0aba99a259a542530f2fd0f6633

SHA256
f29c117a01867d284a6e7d70cd3dda2a6b8fe50419d2b12969487880becfbcfb

SHA512
753b817fd0f7d2c54c6766715f1d01a042a8f972bf4864fbecae3a53df02e99cfb5d33321e9df44d2cd333a0dde4c321000ba1032af286dfe1371b2cbc687336

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe

Filesize
184KB

MD5
032391bc27a81013bdbda03ff0f396b0

SHA1
d59139bd8c456094cc0525b3cd3f94794d74dd98

SHA256
6685d78c8ca0ad05693896a9f151bc82fedee0a922e6c2dce8b2b5eeb5112270

SHA512
1a34fb2ccdc081724f6a32e490f667f1a8dca47acdd324b86f9f6313f40466ba17031be6f6b31a314fed7546ff24083e06e6075fedc2b5586b7ca2b4f5cb8496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe

Filesize
184KB

MD5
d36f01296fd65ba91e5b8eecbd9f8829

SHA1
8d978bce768bb0c73747b18996d121e7fbdc7c6a

SHA256
c024d3a0839a2997b01f16fee79394a2786512afaebd51ac0af0aaac0a92c046

SHA512
ffacd5cafb2d0ce08224742badfd7d13e4e8eb46bd3ed6a553b7479d9c478b0890bbfc1ef9a9769042007ddd81c7159d6f130f83d945c40fdcb34de2bf0d6657

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe

Filesize
184KB

MD5
93a6df8a55a98c4fffb9f27a3280b474

SHA1
129cadb38bcbd61047538ace4e3aa4520c793290

SHA256
aed831bfafb757af50761d9d147ce2b4c603ca895ec9a004681deae0f3a10854

SHA512
19448661b53e2ba821cb44a7348f6df19fdc4761c093d6f20920c233f2b4fa7dd4fe7fc5ed85d579edbe46efd5ea5e65478e75d2c6434e32993d6654c85e5df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe

Filesize
184KB

MD5
33f8888d79432ec3cbcce1618a52934e

SHA1
fd3508f65b6698811f3d563eb53a5023624375b8

SHA256
e9d87213eb25bf5d4f6ce419dc84a58fce0a37fdb9e617f7b5ffe85f9bd61293

SHA512
a58e14f0807b89dac7186ebc407a7f9a1479331d748625fa73402d4e1e000a2e62196990f39a34d14140a3e1fdf508581fc6b9ecbd5619092beb953b14265667

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe

Filesize
184KB

MD5
c5e80440de4deb469d5f68295b910101

SHA1
b8e0f098e46032921a5777a1dbbb33f478fc7977

SHA256
62ce863f5fec8eca7db267a07394338225fe74d0126cf702a8a0692e4a92d642

SHA512
d19c0d876b9bbbb26e53fcc3369e7d4a4f5dda154ae9008fde08b1ae4070eeede90a580bf52dbea6117b73cf121cfec6c32d01cb0e25c6cf121b3f445ce8b2dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe

Filesize
184KB

MD5
f9377b865f35d3546a34074fcdcd066c

SHA1
67a93215d86fd323524761e26f6d6ba2fd519bf3

SHA256
1eaca92180eec0afc65a24f3077d92b7e1fd75cff5dad0cea6700e2c16a28d5c

SHA512
0f34450c7e8da2601808f1733bb8017147177d8662d3500eb75c3be5332f8b08d9a507abaa4d1dc15fae91bd2fdd13cffedfec226a987c3e6c6a9ffc14536f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe

Filesize
184KB

MD5
2c2b9fa5d6838de3ff0508ae997810d6

SHA1
511e629ed2c5618a6b9c91bcf71c959edc767a79

SHA256
5b854dbc883ef93e338b71a16f02b7893239e4192b7da7c30b31f2159f575e7d

SHA512
8f9e903376e59066109c36ead6d6b859d4ec62f17dfde18e97922a6f13a7c3f7d53a03092b664296c15b8ada4d7f7b936992af170ea4d2fafe1bd6890d44c4d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39523.exe

Filesize
184KB

MD5
df9f9d8c96cf28dd8aa346f7fe3eff5e

SHA1
07fae1bab8002bb055e675a8cd44ae8d8b331611

SHA256
d126f5ddb9b9bb0a49f5af73f6aed4b397d99f2dffa93c682f1114b45aae12dd

SHA512
888af7b6b3d7d732ed25f5d6b5e436251bd92711638efdfda0f29e6eb8db8efd1f42d9fcaaab0f192357759f3af6839a520aff7e2654bdd243ae2f04e1deec9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe

Filesize
184KB

MD5
dbb68fe63934f51e0cf482b22a100136

SHA1
e064d6b818fa2ad14380bbb4f39df81b8fbab9b1

SHA256
2d169c27ca6a77706d5581c8d1b4d5451db6b9fe0c98c1c3d6f51e29b8e8ad47

SHA512
34a61dcc8258c1b2a9b916982426b54797bb3f1b9fbbc6b6050589917e606fd85f464145e4b1f8fbb3380dc1f3cefafb88b0794a81ec5d806e4e342540529d6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4297.exe

Filesize
184KB

MD5
6f34d996a75b4b26ec1f704b51ca6661

SHA1
e5b8af70891396945f6ecb753966f6c23d27f3cf

SHA256
a4c91a7648c71f3c6d44cdec371c65837e8e4962cfc00101940d313e40fc143d

SHA512
28df469549f77d002e76a97ca30dce979efcc10a7d33f571e417377ffee04e1c38e57b8e2f1c3d8c721be4aad82b32237a21b571eb1a6e1b8760698e92f3e2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe

Filesize
184KB

MD5
882a3768069c8bef02aa73bd6885824d

SHA1
6a8218b36f21daeaa7d11bf6e4c46132babafc7d

SHA256
85a20499f5ee351f16cad55dae3a29553e87dcd3a4dbea800945c065eeeba61a

SHA512
5627fa7c79f1c197e57d49381db42cc15b568aeb67ab1390cc541f6a11c6ab26c35a7c8a8e222cdbad9e90333464f6424e2cb8630a3bad8d22d078c22da544e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe

Filesize
184KB

MD5
01332b84be56c3c7c65602903a0a2494

SHA1
6f026d145810525b33f1df8df7a636ec3be355d3

SHA256
65d6090a7f0e54615b33a63f4a0fc1593e04ecaa822c6329a0dc3c2f487aab6f

SHA512
d2c5c9f1eb3b1a257b343d4455a8228b24f94bd651ee97c81453541a7faab265ef7a1a7564391a201e6b7f328c1592a521595465a1deac6d60ad5b30846debe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45403.exe

Filesize
184KB

MD5
2592ce3b5b5c5b26b51d227ee0c57c88

SHA1
a839a862a60cf8ef23bd35881c766fa6b4b410b6

SHA256
fd7cd591da7c998dc6d8a46fd6f02fb10985e27a8169668b0fb1bcbfa2055e72

SHA512
6332fc47765f0318dbfed1bc08dc56bdc19ca24a52b6b6d65f28c3ee8f1cfc4ddd2131d80bba8190519cd037b2aa5a0a481b62f74d60ddbb08ee67786208bd49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe

Filesize
184KB

MD5
8e882af45bf0d6e37384cea190a23efd

SHA1
8bee16ebd2c9873c8845eeed69b9d94ad4d1a218

SHA256
5736dede6e129da1f1d6511adda5336a609ddf0904fc23bf4186caaeacb74acf

SHA512
1640383bdd8a66f7e3949598c178b4a2046e897e84fe1435b037af7db00d39e405e7e728d0a7457cbd1e3d092db1f9ced8816b87ef095442dbc16e90307f715a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe

Filesize
184KB

MD5
07b1d3c39efba4333c2be9522e6aaee7

SHA1
d8f46360095187e0da46dcdd598b4f8d96059e70

SHA256
96c6dccf6a5667698f1c32c4f0749f829c4065e7e4dd5c0145807bbcb54dbd43

SHA512
f556c99986b80cdfaa8f993d576a116c0e11a8c2ecd164f997168cf08410d4c7ff8ce8f9c9384cdf737bd5238df5e0a3515495c1dfaa3d7be850c13dfeb71a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe

Filesize
184KB

MD5
fabd37018276f3d1e948d914399c3ad9

SHA1
280f5f52e54de684d5386d0fd84bbf9832212777

SHA256
b2bc2b286e6152632956bd69a10ce6b76993214e6e73dd9f7d516bfb8759efad

SHA512
4055c2dcdd320d5228064e5d559f52b2d77f888d3b8ac4846d44f159227027d637746769083f747b9e527347bdbb26f5c3de9b86539b7f80ccab778d6111c21b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe

Filesize
184KB

MD5
1ed570a524c9bd7fcf2c1f8e72c5eda3

SHA1
c44a6112458280e8ff90ea6592cb233cf023595f

SHA256
a1e4ee3a23dd23eead7c2348519d00dbe70e666f40af8ff38e675ef2b5540d15

SHA512
1823f9d59a04427f25c9fb85e021fbb3ae251f610f0a90d05cbec27efb7ef29fbedc41d7919f66bea8b3ec78ff4b63e098c9096b835a2367b5b88d7426b7ae03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe

Filesize
184KB

MD5
a1c7a2189fb8df4a7cbef594f7a1fb7e

SHA1
62c1eea1dfe8047182b7a57db21019e0d0f2c658

SHA256
e1062ac8b11a38bf22eee13d7fdccf14f626a60a07a1138ab9d3c2343e95f812

SHA512
16c48e3df710217332a79bbf04660e67e039394a09fb8ee4ee86bf7b483b7c385fd07f043ee53825d14645cce4931b1fa5651458f52e20f3f248220ea106a7b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe

Filesize
184KB

MD5
d93098dfa5adc5f2a96f8ce792cf8058

SHA1
7c27f79bea881d54af9d3feaefc03c40fdbd13f6

SHA256
68962538185435eaed2d147e946230782cc73de623546e51362fc276fbdbd029

SHA512
fac36be0ad4e9c720fff2fcdbccf40c63fc9284f525578833b8bcd1c5ee422f686172ced4c14f5b582f92cf24d5117e838932bc196517b3570e7b0c624ab5d97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe

Filesize
184KB

MD5
d9c1d2d540ef9aae03d8d6155c739f9d

SHA1
d700e680eeacd3b68a19f6ac169996a83a75d4ef

SHA256
07241983b5ddbc7cf74d50d1334352d04470f57838ee34c9f0e98f530cdb9e9f

SHA512
d57bc5052f50a8c13c1238c80ce02047880429d2a9fca280b65f89478041ef7b795355df9e21f6767a66a80cc1cbca4bc59e341569091d76706eef148d0a148c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe

Filesize
184KB

MD5
f87d7f0686b0e6df9a989668869208bb

SHA1
8593d7bd47555f6df21c18b9904b3f819b179544

SHA256
9bf7f6f8e86de39742e4ce8153d5bf40eeaa3ab7050370e07ecf46b63daa85a1

SHA512
6528119dde613785a08732180beaedf76c9e6167c277f7aa2d2a5551a327176672c631f3fb54ec6ac0883d0fbb0861870623e68ed2cfb0c8571c590a04ea7494

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe

Filesize
184KB

MD5
c65749d0e4e53de3f4b647707b143c1a

SHA1
41379cdcc6e018266f2b8d06edbb824e23c129ad

SHA256
b53024e64ffc883fbfb57296720ba916b5367515dc9e435fb11a7567b737eb0a

SHA512
966f4eeb7c3bed62650842c93cdb64f9582d9de1db64ff0c1d1a896c32ac5f9a54af1b231d5e1a560fc59f47e7b64b0e7452a066a224368d38ca7e422c951b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe

Filesize
184KB

MD5
35a8187c9b7de2f2b13cb9315e5cf95e

SHA1
7070cb3b6a3f7fde90e9ac7e12b8c2557843aad0

SHA256
d63a7a54366bf7c55887ef816d2ad00eab9ee544b1350c7b346f98b427c750be

SHA512
9580bf0353e6e26f6716f0a5f30947b5716849346708a599f1d67c6cdb2225632ae750d1293d4c159aa8a3f9d0c691d4dc12ccb824f932b14907be391c4473d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54587.exe

Filesize
184KB

MD5
5ed5921f82da84ea65e0700cd5046ff0

SHA1
481cfa0908b67264526b2e702fafc7b82cafc097

SHA256
48793c4adc1b2246285a85914df0039fd81b24e9280ece95aec6063c0d9c60ba

SHA512
ff0f548b7a500a3426b3cfbf632e585836d1ac5539770f804017eafea8fefad8cb82ca012c7568178a1a3ae13ea12f3c6d5dd4d2b618f813635e3a5aa020a45f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe

Filesize
184KB

MD5
e03b5408f1a63b5b64da979ac80a23b8

SHA1
4824f1e11e4ebf621303d0787b1165eb0e41093e

SHA256
8b0667d51b423f91279a313605affc5ed4b0fdfa12148783dada24ac985ddf9c

SHA512
04a9056c3205c9e7012b560f0326b8bf96913703125323c17ba91f64f5587b5a5408e3767bd7cc0bda78d63351a11d02f4623e9b218efe6ff2381301f865aea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe

Filesize
184KB

MD5
d6882220e0855d38326c3a32862ae190

SHA1
b024d70d6ce0029e5503f1806aa0b88aa3c250b6

SHA256
b20d15eb30ca0dcd97fe15ac2b89404bcf60d44eb42e27f9e67ed7ac6ecfbefe

SHA512
cf1316348a544437ab85e93e7e820f1e3b48d5136a4c00a453ad27cdce693df8864839660459a012b4d4732c0c7d0fe96bf150e5e2254d4a6eb9867b117fdcf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe

Filesize
184KB

MD5
54a8109284dffd493805c057b2945977

SHA1
467d61076923ad8909c16995c91d14318dc27d2d

SHA256
3b45446e37df22a8a2e67f4a2da12165ab82cb148d0fa4040f6a2d02b15804c1

SHA512
3cdf7ab9c8fa481dd0d6d3e92ddec4171e1f6ac2a11d95fee22181b9b1a321cc20db8725a576851623d40af9beecb430034826fab5ed9f2d9204bfcee06811c0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads