574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe
Size

184KB
MD5

f3cae1501d8c8d91c64693313507f160
SHA1

507eb0644ca26a6fec3bd3d1f3941ce5bceae806
SHA256

574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21
SHA512

ddddcdbe3b40c4f63791f992a5d05390d734f8df94d6925adaa4bb25dc0308f80b91ddffc79e7fa9d347a8b5a0bbc95c9bcf47f8028682c23a4cc25e5bb979f9
SSDEEP

3072:1rz4Fdo/nJOrdjntZpq8t5a/lvnqnviuc:1rkoIRjnM8ba/lPqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1896	Unicorn-1728.exe
1204	Unicorn-32429.exe
2140	Unicorn-4395.exe
5024	Unicorn-22253.exe
1876	Unicorn-5916.exe
2392	Unicorn-51588.exe
4524	Unicorn-57155.exe
1356	Unicorn-17733.exe
3964	Unicorn-55236.exe
1672	Unicorn-17541.exe
3532	Unicorn-17541.exe
2972	Unicorn-42791.exe
2200	Unicorn-1204.exe
2524	Unicorn-58308.exe
3128	Unicorn-60611.exe
2448	Unicorn-15725.exe
376	Unicorn-7556.exe
1408	Unicorn-53228.exe
464	Unicorn-50627.exe
1212	Unicorn-12003.exe
2956	Unicorn-3280.exe
3100	Unicorn-36699.exe
1680	Unicorn-20769.exe
3376	Unicorn-4432.exe
768	Unicorn-4167.exe
4076	Unicorn-51587.exe
4896	Unicorn-44703.exe
2148	Unicorn-4432.exe
2388	Unicorn-33767.exe
3724	Unicorn-39409.exe
3540	Unicorn-7291.exe
2188	Unicorn-48324.exe
3076	Unicorn-2652.exe
3112	Unicorn-26965.exe
4632	Unicorn-10628.exe
4600	Unicorn-56300.exe
5064	Unicorn-10628.exe
1040	Unicorn-20642.exe
4596	Unicorn-222.exe
4100	Unicorn-59372.exe
3596	Unicorn-39771.exe
1000	Unicorn-53507.exe
2436	Unicorn-38833.exe
4508	Unicorn-60000.exe
1484	Unicorn-39985.exe
1008	Unicorn-39985.exe
3664	Unicorn-31817.exe
1860	Unicorn-19299.exe
3196	Unicorn-61152.exe
3180	Unicorn-15480.exe
3192	Unicorn-3228.exe
1368	Unicorn-59835.exe
876	Unicorn-63720.exe
4024	Unicorn-36647.exe
4616	Unicorn-42215.exe
2404	Unicorn-9403.exe
3144	Unicorn-9403.exe
4880	Unicorn-25185.exe
2176	Unicorn-46352.exe
4056	Unicorn-45413.exe
4820	Unicorn-27030.exe
4744	Unicorn-26109.exe
4548	Unicorn-26109.exe
4440	Unicorn-48759.exe

Program crash 21 IoCs

pid	pid_target	Process	procid_target
6932	6840	WerFault.exe	251
7188	6832	WerFault.exe	250
8636	5780	WerFault.exe	212
7848	7212	WerFault.exe	339
18316	15260	WerFault.exe	712
17836	556	WerFault.exe	742
17808	15304	WerFault.exe	726
17652	3868	WerFault.exe	734
17672	14616	WerFault.exe	739
3016	14828	WerFault.exe	733
1660	2708	WerFault.exe	737
540	4312	WerFault.exe	736
10292	6316	Process not Found	1045
10816	9568	Process not Found	1167
14668	8104	Process not Found	1171
16284	17956	Process not Found	1108
10612	16936	Process not Found	1080
4932	10184	Process not Found	1226
16412	7312	Process not Found	1205
11436	7616	Process not Found	1207
6000	10216	Process not Found	1228

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6596	Process not Found
Token: SeChangeNotifyPrivilege	6596	Process not Found
Token: 33	6596	Process not Found
Token: SeIncBasePriorityPrivilege	6596	Process not Found
Token: SeCreateGlobalPrivilege	12064	Process not Found
Token: SeChangeNotifyPrivilege	12064	Process not Found
Token: 33	12064	Process not Found
Token: SeIncBasePriorityPrivilege	12064	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe
1896	Unicorn-1728.exe
1204	Unicorn-32429.exe
2140	Unicorn-4395.exe
5024	Unicorn-22253.exe
1876	Unicorn-5916.exe
2392	Unicorn-51588.exe
4524	Unicorn-57155.exe
1356	Unicorn-17733.exe
3964	Unicorn-55236.exe
1672	Unicorn-17541.exe
3532	Unicorn-17541.exe
3128	Unicorn-60611.exe
2972	Unicorn-42791.exe
2524	Unicorn-58308.exe
2448	Unicorn-15725.exe
1408	Unicorn-53228.exe
376	Unicorn-7556.exe
464	Unicorn-50627.exe
1212	Unicorn-12003.exe
3100	Unicorn-36699.exe
2956	Unicorn-3280.exe
1680	Unicorn-20769.exe
4896	Unicorn-44703.exe
2148	Unicorn-4432.exe
4076	Unicorn-51587.exe
3376	Unicorn-4432.exe
768	Unicorn-4167.exe
2388	Unicorn-33767.exe
3724	Unicorn-39409.exe
3540	Unicorn-7291.exe
2188	Unicorn-48324.exe
3076	Unicorn-2652.exe
3112	Unicorn-26965.exe
5064	Unicorn-10628.exe
4600	Unicorn-56300.exe
4632	Unicorn-10628.exe
1040	Unicorn-20642.exe
4596	Unicorn-222.exe
3596	Unicorn-39771.exe
2436	Unicorn-38833.exe
1000	Unicorn-53507.exe
4100	Unicorn-59372.exe
4508	Unicorn-60000.exe
1484	Unicorn-39985.exe
1008	Unicorn-39985.exe
1860	Unicorn-19299.exe
3664	Unicorn-31817.exe
3180	Unicorn-15480.exe
3192	Unicorn-3228.exe
876	Unicorn-63720.exe
4616	Unicorn-42215.exe
4024	Unicorn-36647.exe
1368	Unicorn-59835.exe
3196	Unicorn-61152.exe
3144	Unicorn-9403.exe
2404	Unicorn-9403.exe
4880	Unicorn-25185.exe
2176	Unicorn-46352.exe
4820	Unicorn-27030.exe
4056	Unicorn-45413.exe
4548	Unicorn-26109.exe
4744	Unicorn-26109.exe
3976	Unicorn-5688.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1896	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	88
PID 1892 wrote to memory of 1896	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	88
PID 1892 wrote to memory of 1896	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	88
PID 1896 wrote to memory of 1204	1896	Unicorn-1728.exe	94
PID 1896 wrote to memory of 1204	1896	Unicorn-1728.exe	94
PID 1896 wrote to memory of 1204	1896	Unicorn-1728.exe	94
PID 1892 wrote to memory of 2140	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	95
PID 1892 wrote to memory of 2140	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	95
PID 1892 wrote to memory of 2140	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	95
PID 1204 wrote to memory of 5024	1204	Unicorn-32429.exe	97
PID 1204 wrote to memory of 5024	1204	Unicorn-32429.exe	97
PID 1204 wrote to memory of 5024	1204	Unicorn-32429.exe	97
PID 2140 wrote to memory of 1876	2140	Unicorn-4395.exe	98
PID 2140 wrote to memory of 1876	2140	Unicorn-4395.exe	98
PID 2140 wrote to memory of 1876	2140	Unicorn-4395.exe	98
PID 1896 wrote to memory of 2392	1896	Unicorn-1728.exe	99
PID 1896 wrote to memory of 2392	1896	Unicorn-1728.exe	99
PID 1896 wrote to memory of 2392	1896	Unicorn-1728.exe	99
PID 1892 wrote to memory of 4524	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	100
PID 1892 wrote to memory of 4524	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	100
PID 1892 wrote to memory of 4524	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	100
PID 5024 wrote to memory of 1356	5024	Unicorn-22253.exe	102
PID 5024 wrote to memory of 1356	5024	Unicorn-22253.exe	102
PID 5024 wrote to memory of 1356	5024	Unicorn-22253.exe	102
PID 1204 wrote to memory of 3964	1204	Unicorn-32429.exe	103
PID 1204 wrote to memory of 3964	1204	Unicorn-32429.exe	103
PID 1204 wrote to memory of 3964	1204	Unicorn-32429.exe	103
PID 1876 wrote to memory of 1672	1876	Unicorn-5916.exe	104
PID 1876 wrote to memory of 1672	1876	Unicorn-5916.exe	104
PID 1876 wrote to memory of 1672	1876	Unicorn-5916.exe	104
PID 2392 wrote to memory of 3532	2392	Unicorn-51588.exe	105
PID 2392 wrote to memory of 3532	2392	Unicorn-51588.exe	105
PID 2392 wrote to memory of 3532	2392	Unicorn-51588.exe	105
PID 2140 wrote to memory of 2972	2140	Unicorn-4395.exe	108
PID 2140 wrote to memory of 2972	2140	Unicorn-4395.exe	108
PID 2140 wrote to memory of 2972	2140	Unicorn-4395.exe	108
PID 4524 wrote to memory of 2200	4524	Unicorn-57155.exe	106
PID 4524 wrote to memory of 2200	4524	Unicorn-57155.exe	106
PID 4524 wrote to memory of 2200	4524	Unicorn-57155.exe	106
PID 1892 wrote to memory of 2524	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	109
PID 1892 wrote to memory of 2524	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	109
PID 1892 wrote to memory of 2524	1892	574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe	109
PID 1896 wrote to memory of 3128	1896	Unicorn-1728.exe	107
PID 1896 wrote to memory of 3128	1896	Unicorn-1728.exe	107
PID 1896 wrote to memory of 3128	1896	Unicorn-1728.exe	107
PID 1356 wrote to memory of 2448	1356	Unicorn-17733.exe	111
PID 1356 wrote to memory of 2448	1356	Unicorn-17733.exe	111
PID 1356 wrote to memory of 2448	1356	Unicorn-17733.exe	111
PID 5024 wrote to memory of 1408	5024	Unicorn-22253.exe	112
PID 5024 wrote to memory of 1408	5024	Unicorn-22253.exe	112
PID 5024 wrote to memory of 1408	5024	Unicorn-22253.exe	112
PID 3964 wrote to memory of 376	3964	Unicorn-55236.exe	113
PID 3964 wrote to memory of 376	3964	Unicorn-55236.exe	113
PID 3964 wrote to memory of 376	3964	Unicorn-55236.exe	113
PID 1204 wrote to memory of 464	1204	Unicorn-32429.exe	114
PID 1204 wrote to memory of 464	1204	Unicorn-32429.exe	114
PID 1204 wrote to memory of 464	1204	Unicorn-32429.exe	114
PID 4524 wrote to memory of 1212	4524	Unicorn-57155.exe	115
PID 4524 wrote to memory of 1212	4524	Unicorn-57155.exe	115
PID 4524 wrote to memory of 1212	4524	Unicorn-57155.exe	115
PID 1672 wrote to memory of 2956	1672	Unicorn-17541.exe	116
PID 1672 wrote to memory of 2956	1672	Unicorn-17541.exe	116
PID 1672 wrote to memory of 2956	1672	Unicorn-17541.exe	116
PID 1876 wrote to memory of 3100	1876	Unicorn-5916.exe	117

C:\Users\Admin\AppData\Local\Temp\574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\574b50e250d1654c25257f6705821ee5aa687e2112fee12edc4ef391122c6f21_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28221.exe
        9⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        10⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        11⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        11⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        11⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        11⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        10⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59359.exe
        10⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        10⤵
        
        PID:17608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        10⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        9⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        10⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        10⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        9⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        9⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        9⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        9⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        10⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        10⤵
        
        PID:17716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        10⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        9⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        9⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        9⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        8⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        8⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
        9⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        10⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        10⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        9⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        9⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        9⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        8⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
        9⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39787.exe
        8⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        8⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        8⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        8⤵
        
        PID:17440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        8⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4624.exe
        7⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26638.exe
        7⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        9⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        10⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        10⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        10⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        10⤵
        
        PID:17704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        9⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        9⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        9⤵
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        9⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30031.exe
        8⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        9⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        9⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        9⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7410.exe
        8⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        8⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        8⤵
        
        PID:18256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        7⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27030.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        7⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7212 -s 464
        8⤵
        Program crash
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58915.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39220.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        7⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19254.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        9⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        9⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        9⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23991.exe
        9⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        8⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        8⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        8⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
        6⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        9⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        9⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        9⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
        8⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        8⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        8⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        8⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        8⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62971.exe
        8⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
        7⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        7⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        7⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        7⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        7⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        7⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        7⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        7⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        6⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59476.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        7⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        6⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36498.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29693.exe
        6⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        5⤵
        
        PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7556.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28221.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        9⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        9⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        9⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        8⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        8⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        8⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        8⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        8⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        7⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        7⤵
        
        PID:17964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        6⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        7⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        7⤵
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        8⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        8⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        8⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        8⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        7⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        7⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        7⤵
        
        PID:18000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        6⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        6⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        7⤵
        
        PID:18260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        7⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        6⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        5⤵
        
        PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50627.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        6⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        7⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        7⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        7⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        6⤵
        
        PID:18360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44126.exe
        5⤵
        
        PID:18232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        7⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        7⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:17460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
        6⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        6⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        5⤵
        
        PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        6⤵
        
        PID:14828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14828 -s 484
        7⤵
        Program crash
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        6⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        5⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26051.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      4⤵
      PID:12032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
      4⤵
      PID:17488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        9⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        9⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        8⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        8⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        8⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        8⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42920.exe
        7⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61189.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        8⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        8⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23643.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24234.exe
        7⤵
        
        PID:18056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35659.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        7⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        7⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        7⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        8⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        7⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        7⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        6⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
        6⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        7⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62640.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        6⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40879.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        5⤵
        
        PID:15260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15260 -s 472
        6⤵
        Program crash
        
        PID:18316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        6⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        6⤵
        
        PID:12928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        6⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23015.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        6⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        6⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        5⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        6⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34742.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        5⤵
        
        PID:14964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        5⤵
        
        PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
      4⤵
      PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        5⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        5⤵
        
        PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
      4⤵
      PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exe
      4⤵
      PID:17288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38833.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25533.exe
        6⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        8⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46228.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        7⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25778.exe
        7⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
        6⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        6⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        5⤵
        
        PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        7⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-727.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        6⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        5⤵
        
        PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        6⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        5⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        
        PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
      4⤵
      PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        5⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        5⤵
        
        PID:17860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
      4⤵
      PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
      4⤵
      PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
      4⤵
      PID:16924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64868.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        6⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        6⤵
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        5⤵
        
        PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-888.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        6⤵
        
        PID:18112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        5⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
      4⤵
      PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
      4⤵
      PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
      4⤵
      PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
      4⤵
      PID:18404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
      4⤵
      PID:6832
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 464
        5⤵
        Program crash
        
        PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
      4⤵
      PID:14944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
    3⤵
    PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
      4⤵
      PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
      4⤵
      PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10080.exe
    3⤵
    PID:6632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
    3⤵
    PID:12020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
    3⤵
    PID:14616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 14616 -s 464
      4⤵
      Program crash
      PID:17672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
    3⤵
    PID:4336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        7⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        9⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        9⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        9⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22978.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
        8⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20823.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        8⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 436
        9⤵
        Program crash
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        8⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        7⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        6⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        8⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        8⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        8⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        7⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43191.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        7⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        7⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        6⤵
        
        PID:18140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
        7⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        7⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        7⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        6⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        7⤵
        
        PID:17880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        6⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21890.exe
        5⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        6⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52024.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        5⤵
        
        PID:13792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        5⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
        5⤵
        
        PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        7⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60784.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28712.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        8⤵
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        7⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exe
        7⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6503.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        7⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        7⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        6⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26249.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
        7⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        7⤵
        
        PID:16772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        6⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 432
        7⤵
        Program crash
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        6⤵
        
        PID:17488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        6⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25533.exe
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        7⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        6⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45792.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        6⤵
        
        PID:18192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        5⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        5⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        5⤵
        
        PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
      4⤵
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        6⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33253.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        6⤵
        
        PID:15304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15304 -s 456
        7⤵
        Program crash
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        6⤵
        
        PID:18292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        6⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        5⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe
        5⤵
        
        PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        5⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        5⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        5⤵
        
        PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:12512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
      4⤵
      PID:16076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3228.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        6⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 464
        7⤵
        Program crash
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        7⤵
        
        PID:17124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        7⤵
        
        PID:18380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        6⤵
        
        PID:17504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        7⤵
        
        PID:18400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        6⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        6⤵
        
        PID:17840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        5⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22194.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        7⤵
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28712.exe
        6⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43496.exe
        5⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        5⤵
        
        PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8686.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        5⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        
        PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
      4⤵
      PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
      4⤵
      PID:556
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 484
        5⤵
        Program crash
        
        PID:17836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
      4⤵
      PID:18384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60317.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43701.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        7⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
        5⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        6⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        6⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7410.exe
        5⤵
        
        PID:16892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        6⤵
        
        PID:17448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        5⤵
        
        PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
      4⤵
      PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        5⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      4⤵
      PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
      4⤵
      PID:18204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        5⤵
        
        PID:4312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 436
        6⤵
        Program crash
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
      4⤵
      PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
      4⤵
      PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
      4⤵
      PID:18224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      4⤵
      PID:16516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17033.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        5⤵
        
        PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
      4⤵
      PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
      4⤵
      PID:16908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
    3⤵
    PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
      4⤵
      PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
      4⤵
      PID:14496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
    3⤵
    PID:9836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
    3⤵
    PID:12548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43295.exe
    3⤵
    PID:17292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
    3⤵
    - Executes dropped EXE
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
        6⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 644
        7⤵
        Program crash
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39412.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        6⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        6⤵
        
        PID:15420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        5⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        5⤵
        
        PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
      4⤵
      PID:17508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
      4⤵
      PID:17456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
      4⤵
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        6⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        5⤵
        
        PID:16300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33792.exe
      4⤵
      PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31530.exe
      4⤵
      PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      4⤵
      PID:17220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
    3⤵
    PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
      4⤵
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        5⤵
        
        PID:16176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
      4⤵
      PID:15896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
    3⤵
    PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
      4⤵
      PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
      4⤵
      PID:17736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
    3⤵
    PID:9904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
    3⤵
    PID:12860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
    3⤵
    PID:17068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
    3⤵
    PID:15972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        6⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21886.exe
        6⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        5⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        5⤵
        
        PID:18232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        5⤵
        
        PID:17548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        5⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        
        PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
      4⤵
      PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
      4⤵
      PID:15252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
      4⤵
      PID:18352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      4⤵
      PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
    3⤵
    - Executes dropped EXE
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
      4⤵
      PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23364.exe
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
      4⤵
      PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      4⤵
      PID:17996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
    3⤵
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
      4⤵
      PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
      4⤵
      PID:1096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
    3⤵
    PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
    3⤵
    PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
    3⤵
    PID:14756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        6⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        6⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        5⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        5⤵
        
        PID:18144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1960.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      4⤵
      PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
      4⤵
      PID:18300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        5⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
      4⤵
      PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
      4⤵
      PID:18012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
    3⤵
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
      4⤵
      PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      4⤵
      PID:18364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
      4⤵
      PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
      4⤵
      PID:17984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
    3⤵
    PID:9804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
    3⤵
    PID:12532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
    3⤵
    PID:17352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        5⤵
        
        PID:17428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        5⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        5⤵
        
        PID:16784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
      4⤵
      PID:14240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
      4⤵
      PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
    3⤵
    PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      4⤵
      PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
      4⤵
      PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
    3⤵
    PID:9748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
    3⤵
    PID:13020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
    3⤵
    PID:17208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
  2⤵
  PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
    3⤵
    PID:6412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
    3⤵
    PID:9532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
    3⤵
    PID:12884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
    3⤵
    PID:16928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
    3⤵
    PID:17124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
  2⤵
  PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49456.exe
    3⤵
    PID:10140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe
    3⤵
    PID:13780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
    3⤵
    PID:17104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
    3⤵
    PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
    3⤵
    PID:17036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
  2⤵
  PID:9864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
  2⤵
  PID:13260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32012.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32012.exe
  2⤵
  PID:17088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
  2⤵
  PID:16000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6840 -ip 6840
1⤵
PID:8020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6832 -ip 6832
1⤵
PID:8056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5780 -ip 5780
1⤵
PID:7848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7212 -ip 7212
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 15260 -ip 15260
1⤵
PID:18224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 14800 -ip 14800
1⤵
PID:17520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 14728 -ip 14728
1⤵
PID:17532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 15040 -ip 15040
1⤵
PID:17636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4312 -ip 4312
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 15384 -ip 15384
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4176 -ip 4176
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 964 -ip 964
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 16168 -ip 16168
1⤵
PID:17964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 15756 -ip 15756
1⤵
PID:17992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 16392 -ip 16392
1⤵
PID:17780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 16892 -ip 16892
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2732 -ip 2732
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 17124 -ip 17124
1⤵
PID:17576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 16916 -ip 16916
1⤵
PID:17580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1840 -ip 1840
1⤵
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 15816 -ip 15816
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 17228 -ip 17228
1⤵
PID:17668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 16368 -ip 16368
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 16100 -ip 16100
1⤵
PID:14800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 15868 -ip 15868
1⤵
PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 17096 -ip 17096
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 17088 -ip 17088
1⤵
PID:17812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2096 -ip 2096
1⤵
PID:14492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 17332 -ip 17332
1⤵
PID:13948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3860 -ip 3860
1⤵
PID:15352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 15444 -ip 15444
1⤵
PID:15048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 17316 -ip 17316
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 17044 -ip 17044
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 17080 -ip 17080
1⤵
PID:13932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 17268 -ip 17268
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 16424 -ip 16424
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 17724 -ip 17724
1⤵
PID:15384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 16452 -ip 16452
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 18180 -ip 18180
1⤵
PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 18192 -ip 18192
1⤵
PID:15472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe

Filesize
184KB

MD5
b99c4db667022dba7eaceb3e2872ad43

SHA1
76ef8882181a8435da00906b06a36adbfcd12159

SHA256
7e00a1d6ecb27411e7414f7deb476a685511a6fbaa9e10330d28f07bf10baa38

SHA512
16bdc4cbb6f20b2edcb2acd57c2a606365d901f9bd92a9f02168bf2bca49066cbc4fae724ea56582e801bc628de6722059a5cfae7f530af905bcf0649c9248b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe

Filesize
184KB

MD5
1d761a34ef439514310c558c92baf650

SHA1
269dc8de5dc44b9aa082e1cda1b9a7a47c9590b4

SHA256
6c7448f7a24c50cb39f0c742ad96ddd365311e0b73565400c99e223bcca8c501

SHA512
e02b970a49e11f2b41139402383d40a4d5dbfb83d8dc50a561f019654da3564b13926609566722f820c7509c1a63486f294f0004ae5fa19de8839eda3e1d2491

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe

Filesize
184KB

MD5
0a10c0b8c16dd1010b1b3e02cf155b71

SHA1
868c1d041a15ed4e4eb9677edb1cbcdbfbe3724a

SHA256
84ebe95b5affb1dfc304f7bc8a0d0abbe559cbf6a58a4d74eec9e8b4a6686abc

SHA512
8972701379c2491e56298da731da5ade7cd7c8102c6e901d656afae2fbf80111e4b76584663f1173af78df2f2e485c45eb56dda88eaccb902a8a7b14c3a12d69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe

Filesize
184KB

MD5
a416a84bef2c0c199630426aba8c9b6f

SHA1
0d04c3361084765f200e4af7f721011885ce47af

SHA256
b941b3e1654e0c9b0f9207c5bb08fcc8424650493ab74a142711302b97aa658a

SHA512
376c07042e45d8bda5d8c2bc6db609c7847a10430de62cc0ca77e59172413fe76b4b22157aaac121cf531f614d229f966e01a63df33cb167fee9026af8a40257

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe

Filesize
184KB

MD5
d437229f29a9456fc901978850a0d8d1

SHA1
f41b63cd880c97a9e6f528704f9041985397df73

SHA256
5981a61ac19e43486aded6f2c35f03bb602c3b1875dcddf0008c668bc13ab180

SHA512
302e2af508972062e897e918e597f9448dfdbac11c68678d4fd648cf467262ef98d41581214dc46ce27c9c126bc5546140f3e2f5efaf497f6bb8c4692dc5f1d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe

Filesize
184KB

MD5
f64ad1877af5ab3c6704c87e9017c21f

SHA1
e9140c3f77f6f326996ecbc5daeaae4d1862f549

SHA256
0747c4d9b8d47d8653d87ab4168684e2a60cb055c7da78b708e962fc80f1021b

SHA512
842d449fa40ed8a4a1e31e28eaa931bfe03654a6405d5e5bde4f52765be9c582805f92e2ba2440e9a6e2980a72ad407bd630f29d9dde37f736187bb9a9827c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe

Filesize
184KB

MD5
5c6d11ead9d048d483ea09a1907ffbf0

SHA1
5e664bd2964fa2606b1822a2ae619316e5f16c2d

SHA256
95e43d5d4a3a788b90433504977907374291403f58df44386241508404465702

SHA512
5cce0ee66f35bb4566cdc5f9f91ab08676fa203b17a5bc945923941ef4e95cbb808c0c180c6b577deb9722c8852e9587f2c1c559d4d566454821ac6788c49e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe

Filesize
184KB

MD5
ca6e93312221d2f68edc8bfb368bf1de

SHA1
8571880dab8f6325171dabc9d681a802c02d54af

SHA256
fbf768f0cec34257b48b5ca5f326459da6864c1c18620537e59a20349ff0ce91

SHA512
20dfe2b59b28db54da4e30467db1556311fa0872861dc6f9266838701c74b9b862865867ae5302c697af8dc8257ae0be9d4a8ac4847925a4fe936aea6a7fc63d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe

Filesize
184KB

MD5
cf7ea10d0b4a2f9f23748e50ea4c11a1

SHA1
8e41f1bd84026a2dc6aa9e507cb22b8cdd7db336

SHA256
b63eef303a6498967c04eb934276673c5298140a87b6f398d698c22948ba66ad

SHA512
9dfda7ea3b27058a7703073ec9e23f3fafcd59942809f67b8d6aa4fac388eb5d9002784ad77d1677be648c4c9db1dac7842d6167032d531da43cb14457c3818d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe

Filesize
184KB

MD5
3439dbb6b3998ce8fc7ce272a3430ac7

SHA1
b5698728c25b655161273d4990ed1502097ecaa2

SHA256
8e6d2acaeacd90f1ea7112842426ab36244848557363166989752ae754ea1aa1

SHA512
40fdb1bdaf096e2adb22b68e176be146c149dd610254b79d6be1d9b55078dcd73455f5cfa1b3e02f4b47038e984bd10f527643d0befa57eaba98a9c30f8b6019

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe

Filesize
184KB

MD5
1114189e98c22686d0f8f762dce0d070

SHA1
7d340eb16b23252723951a035152af04849f1a4c

SHA256
77debbb2801d9f4367754890a90bba1488fa19db32c4012955ef324725204473

SHA512
149ae2fedd2f67b53464aaa4c8e3722ebcfc11259fd29ea3b809b33a69daea7d3ed2af77e657cd625f4becb5727bab469aaf51bf2f9efdcf712db11b0e621929

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe

Filesize
184KB

MD5
02ea8e1ffd4ae606b61f77c35f2c3496

SHA1
a132a1d3bf38dfe18922b147673bf19fc3d2b6d9

SHA256
afe3d860cabbdf0df3cc04532a6e635836cc8380c8e4d9325503b8195e0a6874

SHA512
f46ea99a1fb433026daa9cbd73e4f4c824e76bbeeb2851fafa5cce124c8eb576ba73109403bbfe8f0a0b55fa736868e3fb99369e94fb760c0a45ab7106095759

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe

Filesize
184KB

MD5
dbfe9d2c85f7841b26bcbf0e639d4ac5

SHA1
8f46268aba30217b3912899982dfacff2be89080

SHA256
2149951e42bc9fffac615323371ccbebd657f8c4ef3a70939481fa8f89f79a80

SHA512
b6c84019d81b22d1ce9165dcbc2fcc5a3bd4634ea79db80f020acd6790da0b86b458025e0da8a2136c77e7502a2482bf6b2db6f46053abf92f77078690e0e551

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe

Filesize
184KB

MD5
16a3b89ec0186db8bddd2dfc558fee18

SHA1
72b200a127da917d939b845a8ea41cbe82f2b640

SHA256
7489621cd137ee444d570a937198dd96f7fba4d7396fcb87abdc2558f4fb702f

SHA512
94112dfcb6702ea4d9a84f038bdac5bd62c1a2fb0b4a3c8520d4d2cde3b2a7bbdf54e647291b883c2680278a49634cc027c424bdd987e10177c526a78da14c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe

Filesize
184KB

MD5
cf3ea419dd5b6acfca85c090ee820a7f

SHA1
d2265ad684bdf526622d2454a944c684672d4ab8

SHA256
3f3752126a03d3e58731133461f93f745930f954a1c4e2966fedb6f62a7be7aa

SHA512
59e552bbcb472a8e7e9e3dd2ca181740ca4bd09bb4396e45aeaf7df0c2c6aec65ef063e5b3072135ddf4ad22feec8a89a4bd8c177b8d17a92ee82ac8924da7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe

Filesize
184KB

MD5
a614238feec27ce8a0b8d0428e432356

SHA1
e0d3de6d4a8276ea93eb21727855165dba526a20

SHA256
f946fadc161dcdd2599334ae8b635cad78f829760466485e517fc444b33c8e07

SHA512
ffe3f251fdc5cb3aaa369387670818e262c70630f6c256f6b011c0749ee5d1a025d238fcd727145863b178b32ffe0767d738a0790cbbc0c0020a00073826a06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe

Filesize
184KB

MD5
f1300d39eb60900709665e0520546fc0

SHA1
f923f18bcd832ed45586ca327a23d4c71cbdf8d9

SHA256
456c23fb2b18bb097bcae0df5c710f1cf00a99b69ba7af191800799b0dff5daf

SHA512
86c90cc9692d417ecf42c6140927d0cfa8dc0632292a16c3f0c506b6d5da3cc5d59d2e212c0be0e9255bc39efed19486f0c8d53a3256bacc727bf626928c7e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe

Filesize
184KB

MD5
7bde07964675be570e06d211834554f2

SHA1
615fb2abc33722b9da91858e661073fe3b9ac3cb

SHA256
f46600ab68d0be2112ca77c706505922779fd7f7e86b7198d5e00996e7d9405b

SHA512
58c611b3d9adae857d249862705fb53298688e9f0b872d5be94d985048777a7c791268be255664a02dbc91f43fc354142de4175f24793bfc05c1b544c26ff39e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe

Filesize
184KB

MD5
aa6b94b7f70c91dcdec91965ecbc4569

SHA1
40350eb28003a20b00121c01dd4c0c9fc84ed319

SHA256
de2307ca3601c4f1cf1fe51f544fd42a21183dcfbcf2294458c38f904e15b215

SHA512
4ffa61fa7fa0178ee5135469571aa190bf0a12ea479d79530f566f11e2b73485845c2f3fa7701a1ce40a3dc652b7986a4db31a9686c4c3af19e75cbae4516575

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe

Filesize
184KB

MD5
7b0a5c0da4d1ecd3442023f74f21d693

SHA1
a0a7e3df095bcde7171f4dac3f267a019c329fac

SHA256
b4d2d2f68d814715aa59a00901ceda894203b8b0dbe3b807997276354f514d9e

SHA512
9d04fa868ab1dc8574b7be1ffb5405b281df9b521ef204f3c06275f4964ec5bebccaddf65f99af85d634b1d0e5b54b61089f96b5ff57277b009dd73808e23ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50627.exe

Filesize
184KB

MD5
e1f7db270f020bfda9062dd2fbdcaa11

SHA1
f6bec23554a7787785333eb390fd8f4640479e1d

SHA256
876a592cf8eb7690c388e6397efca28480dea05c80d625f4ae224a229f63def2

SHA512
cd9f48d5ae4bc79683599fab7c8231bbc4aa3303517ed1fe5ed58dac58f859d7693c69a2705c7ddd019249953cd3722a4075d1b89f1d2d12e7234b14657a53ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe

Filesize
184KB

MD5
d70f20bc9ad1c03b1389d75a999b415a

SHA1
4a9be08c86cb7e0f99b71ecc623a8b9983c2d3a0

SHA256
39c743f47e20712827c33609668f282e6b3aa8cf2ba6be236e46cb3e0366c1d6

SHA512
8ccea0b343adab360d381bf4bedf64875b917b9b61ce60991072251893f0f7ed8867d7df1a84bc79b40f3e1137783115bd918b797fb30180d33e26f8162d1d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe

Filesize
184KB

MD5
10afa7defba4ea66ab538daddf41b6d2

SHA1
984835634830d20637818976b30936e5a8098eea

SHA256
f694e3a1676e6c788dc17edcfbaf350192b68b6b2c6ff5c4ba8bfc6f17229893

SHA512
6de3ada00ff2a26585b2795d05b04c1e639f020efe84a3599cc4d2c573bf042b3399ede693ef07392355934be0a648136cbc1bb51c250caa463f32a07405b5ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe

Filesize
184KB

MD5
4a759043bc581dffd29d428f81f20a97

SHA1
d60937764c679d56f2b2be1cfbf46ff66348f43d

SHA256
c355d2560f85391754311fb6f6b118e48093b194085a04b0feba87108d2f2481

SHA512
5bb9834a874c724e94fd7abefe28ded08afddc732269f8eaf4fd33b2f031f3b4abd2b0e089c453c646082411c1775c4c5ebcd12257e45248cdba67db9472a4a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe

Filesize
184KB

MD5
8c3fee39c8a652e4e9c4525168c5c622

SHA1
2c1fb55cc2cc0cd0aa55ea7c01a29239e38e776a

SHA256
e2f862b1cb85ac172988e36af1959a57238a5ba783f0db9460057d77761ff81c

SHA512
a8beaf016ed911672f33ee1aa1b9fa399e214d5c243732a6fbbed889a37fb7a2f5db1544b57f2bd6937beed452f10d29a16d5933c8c8648f760171f619606d28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe

Filesize
184KB

MD5
720e10d1e3dc2ff2a9c0d044b1a9c66b

SHA1
3c31713955e018f28f0d920455b140dd3ffd8bfd

SHA256
b6964418b89552e7e87b474f31160497a7d0bacf8eb502eb8d4f9f98a12726f9

SHA512
f1fc5e66d914559871194dbe1628639e873ca1c2b455c2f1aa5cf1c27fc4bc51504e17ff967411220e25af2b1ed713d35b2a9c4518136cfa0d7a6e25ecaae5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe

Filesize
184KB

MD5
1b419a5c936028769d46279b17998e59

SHA1
db68f7c16bc0ff1814e531f1f1a536e54a61526c

SHA256
5f01296c7f5a4210b616ece7d460ba2eb1239a5a377eaf4483828364471f7130

SHA512
c2a1ceaba7856acb636c966c08d7891a0f12aaf77a2b305e2a64488cd1028f3329a414a775837d5300b1702b302df71a0ca21ca9853be02015d805561c791f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe

Filesize
184KB

MD5
20c423a07559afbc9e8bc57efab0779d

SHA1
350afb817d7c6515495ae15f868be6a9914f9f53

SHA256
591292f74f33acd1ebc08b5a039c66890d009e8a0d22f3597159fc266141c704

SHA512
729ed4fb188c1e7f3b6dd8df7c724707279a2ccd054e19f8e3213384e5265d2737c39f22448e17c70c07fa7c6c988de88f7cf3cc3482c28d198764761435267e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe

Filesize
184KB

MD5
2c3a5cb1740188eb29da7cc697441c90

SHA1
9008e6992cb5ccb111fa535bf91bd53cf78e03f2

SHA256
52d1358c0b05d15a99aa8c7b0efdb89e5237f36689cbe4b5aba8a478ea2ad989

SHA512
4a2530096f9d6218cc40215d0f99f7e2c0ca30d29116e45230f68c248475403250d3597ddb513795cfaa73290eb800df6d247d890dc02869187795496ef3c594

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe

Filesize
184KB

MD5
6022657e81cb143f90bafca315e0e645

SHA1
172f1f1c367cbf64372288c81b515d1ca1e42c99

SHA256
3aa330d2f362968a8900d2af57f96aa5e7f4f4d12d49ecc532990b153c61021e

SHA512
bd8d276543c466e3ba5b0b137ea3ec49ced530b090c2772a7644b40975c116187ff0acc3a01dcf35ed474ec3df7516551cd82fb728b0791584d0190b3335d44e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe

Filesize
184KB

MD5
cb57ff3dad081ecd227b3e4e4c5e4a4c

SHA1
315fa1720390b9ce1cf4c56a63d9b8e3722f8ad2

SHA256
50a0a4cdb70901d502af579cdf11b8dfa06d6e54e2ac077426c7e0d01a940860

SHA512
b0c3c5439a44f769d8da3f314dc7a3cc714cf7ae827dd9b1aec1e1b0b8b9391845b31c034665b8a7b092a72a287e6b0f5821bf47d59d9e4c94c1eed7245a8353

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7556.exe

Filesize
184KB

MD5
8ed1f4740c2531c4df58cdc7e472a209

SHA1
c6e909c318efb9b11463148fc8fbb8e99372b04a

SHA256
1bf07e108da9eb08b68cc8a2fd2349fc8a9b9470b13019b30be7734a6afc5746

SHA512
36a602443618255eb629deeb10dbe72b1ae093790df5ffa3b16d85f2afd7a1a0d45bde8f5a819a2f5b1feae79e4ed3f134ab728c0f82bc8ec526dcffe2b6f853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe

Filesize
184KB

MD5
c365f4cb218af34a98e3b356e466f038

SHA1
1aa940b06f8d288f5a445600a19c496d233669d4

SHA256
96431f81955091728e697f4decadd2a05d07a4c63a38b206e26d4ed4794b5c0d

SHA512
2bbd504f6b1f0944ce42ba16fd7c37b70a7687b236db25ff2834f6b89556d4a43c9b0dd3ccf4599e1e9d656195bca115529c924f2045b96c660aae80aff2ef6a

Download Submit
memory/376-117-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/464-129-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/768-182-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/812-3455-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/876-321-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1000-268-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1004-3566-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1040-246-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1192-406-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1204-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1212-136-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1280-383-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1356-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1368-311-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1408-118-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1484-292-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1672-72-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1680-156-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1860-314-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1876-40-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1892-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1896-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-448-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2096-3430-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2140-21-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2176-351-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2188-220-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2200-93-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2280-381-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2388-186-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2392-41-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2404-339-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2416-387-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2424-442-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2436-269-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2448-108-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2524-94-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2536-405-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2972-92-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3100-147-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3112-231-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3128-95-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3180-305-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3196-303-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3376-181-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3540-211-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3596-263-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3664-302-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3692-449-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3724-204-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3964-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3976-382-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4024-312-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4056-355-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4076-183-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4100-259-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4216-589-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4440-380-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4508-270-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4524-45-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4596-256-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4600-237-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4616-313-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4632-235-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4744-370-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4820-356-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4832-419-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4880-349-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4896-185-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4992-3438-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5024-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5052-440-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5064-238-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5124-443-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5148-444-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5156-460-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5180-446-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5244-459-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5260-461-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5280-588-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5284-467-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5336-468-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5404-462-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5576-527-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5596-528-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5632-529-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5664-551-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5696-553-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5704-552-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5740-554-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5748-565-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5764-555-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5792-556-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5804-557-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5812-587-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5832-558-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5864-559-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5888-561-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5896-566-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6024-575-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14800-3245-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15124-3256-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15320-3431-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15696-3415-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15756-3487-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16160-3379-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16424-3799-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16452-3548-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16936-3391-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17028-3513-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17140-3416-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17256-3675-0x0000000075FE0000-0x000000007603F000-memory.dmp

Filesize
380KB

Download
memory/17256-3668-0x0000000076740000-0x00000000767BB000-memory.dmp

Filesize
492KB

Download
memory/17608-3168-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/18148-3490-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads