0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff

Analysis

max time kernel
142s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe
Size

184KB
MD5

040258642eb52b35ad07a251360f7f70
SHA1

6a0b0ac5e56d239f68fd9a3a90e8b960333a1637
SHA256

0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff
SHA512

f896751bd8f996247ed33b5e599fbf5485ffdf84471497be66891a6610f8e429c8cce049ca3c3506f3aacf4b14c158302dc287b2ab77a632363417dce70d0e32
SSDEEP

3072:NObR4CoKGHOcdvnFZDB8j9Mplv9qnviuU:NOTocIvnd8hMpllqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2920	Unicorn-53474.exe
816	Unicorn-36152.exe
2168	Unicorn-12202.exe
4924	Unicorn-16752.exe
4216	Unicorn-31696.exe
440	Unicorn-51562.exe
2936	Unicorn-41348.exe
3496	Unicorn-59512.exe
3788	Unicorn-35562.exe
3364	Unicorn-2143.exe
2764	Unicorn-10046.exe
4860	Unicorn-63596.exe
4004	Unicorn-55983.exe
3052	Unicorn-57466.exe
2208	Unicorn-63596.exe
4308	Unicorn-31975.exe
1256	Unicorn-19632.exe
4716	Unicorn-65303.exe
3208	Unicorn-41998.exe
2724	Unicorn-54250.exe
1072	Unicorn-41236.exe
5108	Unicorn-7742.exe
2688	Unicorn-58334.exe
2648	Unicorn-5049.exe
932	Unicorn-700.exe
3236	Unicorn-19994.exe
1712	Unicorn-19994.exe
1516	Unicorn-33729.exe
4604	Unicorn-55594.exe
852	Unicorn-51245.exe
1532	Unicorn-53456.exe
4552	Unicorn-22730.exe
4744	Unicorn-29506.exe
4480	Unicorn-24767.exe
1828	Unicorn-51873.exe
1220	Unicorn-51873.exe
2420	Unicorn-62200.exe
4808	Unicorn-43726.exe
4332	Unicorn-25252.exe
4412	Unicorn-5386.exe
1260	Unicorn-40196.exe
3388	Unicorn-27289.exe
4784	Unicorn-49756.exe
2028	Unicorn-5816.exe
1672	Unicorn-14753.exe
1704	Unicorn-10669.exe
4232	Unicorn-23690.exe
5000	Unicorn-50067.exe
3200	Unicorn-25727.exe
4792	Unicorn-31858.exe
3812	Unicorn-65277.exe
3020	Unicorn-50887.exe
2780	Unicorn-5215.exe
4960	Unicorn-40026.exe
684	Unicorn-4453.exe
5068	Unicorn-7253.exe
4708	Unicorn-11629.exe
3464	Unicorn-30658.exe
212	Unicorn-19798.exe
4492	Unicorn-49762.exe
1236	Unicorn-40794.exe
1324	Unicorn-1899.exe
4288	Unicorn-14151.exe
2864	Unicorn-36710.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
12048	10108	WerFault.exe	469
13288	7452	WerFault.exe	349
19128	18768	WerFault.exe	947
19104	18704	WerFault.exe	940
2976	16884	WerFault.exe	832
8388	6324	Process not Found	1085
11792	6108	Process not Found	1151

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7444	Process not Found
Token: SeChangeNotifyPrivilege	7444	Process not Found
Token: 33	7444	Process not Found
Token: SeIncBasePriorityPrivilege	7444	Process not Found
Token: SeCreateGlobalPrivilege	9936	Process not Found
Token: SeChangeNotifyPrivilege	9936	Process not Found
Token: 33	9936	Process not Found
Token: SeIncBasePriorityPrivilege	9936	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe
2920	Unicorn-53474.exe
816	Unicorn-36152.exe
2168	Unicorn-12202.exe
4924	Unicorn-16752.exe
4216	Unicorn-31696.exe
440	Unicorn-51562.exe
2936	Unicorn-41348.exe
3496	Unicorn-59512.exe
2764	Unicorn-10046.exe
3364	Unicorn-2143.exe
3052	Unicorn-57466.exe
4004	Unicorn-55983.exe
4860	Unicorn-63596.exe
2208	Unicorn-63596.exe
4308	Unicorn-31975.exe
4716	Unicorn-65303.exe
1256	Unicorn-19632.exe
3208	Unicorn-41998.exe
2724	Unicorn-54250.exe
1072	Unicorn-41236.exe
5108	Unicorn-7742.exe
1516	Unicorn-33729.exe
2648	Unicorn-5049.exe
932	Unicorn-700.exe
3236	Unicorn-19994.exe
1712	Unicorn-19994.exe
2688	Unicorn-58334.exe
4604	Unicorn-55594.exe
852	Unicorn-51245.exe
1532	Unicorn-53456.exe
4480	Unicorn-24767.exe
4744	Unicorn-29506.exe
4552	Unicorn-22730.exe
1220	Unicorn-51873.exe
1828	Unicorn-51873.exe
2420	Unicorn-62200.exe
4808	Unicorn-43726.exe
4412	Unicorn-5386.exe
4332	Unicorn-25252.exe
1260	Unicorn-40196.exe
3388	Unicorn-27289.exe
4784	Unicorn-49756.exe
2028	Unicorn-5816.exe
1704	Unicorn-10669.exe
3812	Unicorn-65277.exe
4232	Unicorn-23690.exe
5000	Unicorn-50067.exe
2780	Unicorn-5215.exe
3200	Unicorn-25727.exe
1672	Unicorn-14753.exe
3020	Unicorn-50887.exe
684	Unicorn-4453.exe
4960	Unicorn-40026.exe
4792	Unicorn-31858.exe
4708	Unicorn-11629.exe
4492	Unicorn-49762.exe
212	Unicorn-19798.exe
3464	Unicorn-30658.exe
1236	Unicorn-40794.exe
1324	Unicorn-1899.exe
2864	Unicorn-36710.exe
4288	Unicorn-14151.exe
4832	Unicorn-22054.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2920	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	89
PID 2896 wrote to memory of 2920	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	89
PID 2896 wrote to memory of 2920	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	89
PID 2920 wrote to memory of 816	2920	Unicorn-53474.exe	93
PID 2920 wrote to memory of 816	2920	Unicorn-53474.exe	93
PID 2920 wrote to memory of 816	2920	Unicorn-53474.exe	93
PID 2896 wrote to memory of 2168	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	94
PID 2896 wrote to memory of 2168	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	94
PID 2896 wrote to memory of 2168	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	94
PID 816 wrote to memory of 4924	816	Unicorn-36152.exe	96
PID 816 wrote to memory of 4924	816	Unicorn-36152.exe	96
PID 816 wrote to memory of 4924	816	Unicorn-36152.exe	96
PID 2168 wrote to memory of 440	2168	Unicorn-12202.exe	98
PID 2168 wrote to memory of 440	2168	Unicorn-12202.exe	98
PID 2168 wrote to memory of 440	2168	Unicorn-12202.exe	98
PID 2920 wrote to memory of 4216	2920	Unicorn-53474.exe	97
PID 2920 wrote to memory of 4216	2920	Unicorn-53474.exe	97
PID 2920 wrote to memory of 4216	2920	Unicorn-53474.exe	97
PID 2896 wrote to memory of 2936	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	99
PID 2896 wrote to memory of 2936	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	99
PID 2896 wrote to memory of 2936	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	99
PID 4924 wrote to memory of 3496	4924	Unicorn-16752.exe	102
PID 4924 wrote to memory of 3496	4924	Unicorn-16752.exe	102
PID 4924 wrote to memory of 3496	4924	Unicorn-16752.exe	102
PID 816 wrote to memory of 3788	816	Unicorn-36152.exe	103
PID 816 wrote to memory of 3788	816	Unicorn-36152.exe	103
PID 816 wrote to memory of 3788	816	Unicorn-36152.exe	103
PID 4216 wrote to memory of 3364	4216	Unicorn-31696.exe	104
PID 4216 wrote to memory of 3364	4216	Unicorn-31696.exe	104
PID 4216 wrote to memory of 3364	4216	Unicorn-31696.exe	104
PID 440 wrote to memory of 4860	440	Unicorn-51562.exe	105
PID 440 wrote to memory of 4860	440	Unicorn-51562.exe	105
PID 440 wrote to memory of 4860	440	Unicorn-51562.exe	105
PID 2896 wrote to memory of 2764	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	107
PID 2896 wrote to memory of 2764	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	107
PID 2896 wrote to memory of 2764	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	107
PID 2168 wrote to memory of 4004	2168	Unicorn-12202.exe	109
PID 2168 wrote to memory of 4004	2168	Unicorn-12202.exe	109
PID 2168 wrote to memory of 4004	2168	Unicorn-12202.exe	109
PID 2920 wrote to memory of 3052	2920	Unicorn-53474.exe	108
PID 2920 wrote to memory of 3052	2920	Unicorn-53474.exe	108
PID 2920 wrote to memory of 3052	2920	Unicorn-53474.exe	108
PID 2936 wrote to memory of 2208	2936	Unicorn-41348.exe	106
PID 2936 wrote to memory of 2208	2936	Unicorn-41348.exe	106
PID 2936 wrote to memory of 2208	2936	Unicorn-41348.exe	106
PID 816 wrote to memory of 4308	816	Unicorn-36152.exe	110
PID 816 wrote to memory of 4308	816	Unicorn-36152.exe	110
PID 816 wrote to memory of 4308	816	Unicorn-36152.exe	110
PID 3496 wrote to memory of 1256	3496	Unicorn-59512.exe	111
PID 3496 wrote to memory of 1256	3496	Unicorn-59512.exe	111
PID 3496 wrote to memory of 1256	3496	Unicorn-59512.exe	111
PID 4924 wrote to memory of 4716	4924	Unicorn-16752.exe	112
PID 4924 wrote to memory of 4716	4924	Unicorn-16752.exe	112
PID 4924 wrote to memory of 4716	4924	Unicorn-16752.exe	112
PID 2764 wrote to memory of 3208	2764	Unicorn-10046.exe	113
PID 2764 wrote to memory of 3208	2764	Unicorn-10046.exe	113
PID 2764 wrote to memory of 3208	2764	Unicorn-10046.exe	113
PID 3364 wrote to memory of 2724	3364	Unicorn-2143.exe	114
PID 3364 wrote to memory of 2724	3364	Unicorn-2143.exe	114
PID 3364 wrote to memory of 2724	3364	Unicorn-2143.exe	114
PID 2896 wrote to memory of 1072	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	115
PID 2896 wrote to memory of 1072	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	115
PID 2896 wrote to memory of 1072	2896	0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe	115
PID 4216 wrote to memory of 5108	4216	Unicorn-31696.exe	116

C:\Users\Admin\AppData\Local\Temp\0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe
"C:\Users\Admin\AppData\Local\Temp\0021a05dcd1f9f4ea5b42bc4ae223f9b4333d12aad7cc59d80498862be8c72ff.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53474.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19632.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        9⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        10⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
        11⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe
        11⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
        10⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
        10⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        10⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-806.exe
        10⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        9⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        10⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        10⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        10⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        10⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        9⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        9⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        9⤵
        
        PID:18196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        9⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        9⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        9⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        9⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49672.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        8⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        9⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        10⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        10⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        9⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        9⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        9⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        8⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
        8⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        8⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        8⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        8⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        8⤵
        
        PID:18872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
        7⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        9⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11723.exe
        10⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        10⤵
        
        PID:17596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        9⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        9⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        9⤵
        
        PID:18740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        9⤵
        
        PID:19140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        9⤵
        
        PID:18852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        8⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        8⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
        8⤵
        
        PID:18916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        8⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        8⤵
        
        PID:18640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60337.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
        7⤵
        
        PID:16448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        7⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        6⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        8⤵
        
        PID:18780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        8⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        7⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        8⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        8⤵
        
        PID:18464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        7⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        7⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52498.exe
        6⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
        6⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        9⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        9⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        9⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        9⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        9⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        9⤵
        
        PID:18704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18704 -s 72
        10⤵
        Program crash
        
        PID:19104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23685.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        8⤵
        
        PID:19396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        8⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        8⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        8⤵
        
        PID:18692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57197.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        7⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        6⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        8⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        8⤵
        
        PID:18952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        8⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        8⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        8⤵
        
        PID:17604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        7⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        7⤵
        
        PID:18732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        7⤵
        
        PID:18828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13147.exe
        6⤵
        
        PID:18724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        6⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14151.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        8⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        8⤵
        
        PID:18792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        8⤵
        
        PID:18868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48110.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        7⤵
        
        PID:18856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
        6⤵
        
        PID:17856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
        6⤵
        
        PID:19176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22054.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        8⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        7⤵
        
        PID:18832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        7⤵
        
        PID:18932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        7⤵
        
        PID:17956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        6⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
        6⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        7⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        7⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        6⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        6⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        6⤵
        
        PID:19280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        6⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
      4⤵
      Executes dropped EXE
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        8⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        7⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        7⤵
        
        PID:19260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        7⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
        6⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        8⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        7⤵
        
        PID:18776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58355.exe
        7⤵
        
        PID:18620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26872.exe
        7⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        6⤵
        
        PID:18840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        6⤵
        
        PID:19172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        6⤵
        
        PID:19148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
        6⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        5⤵
        
        PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48132.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
        8⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        8⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        7⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
        7⤵
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
        7⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        7⤵
        
        PID:17884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19495.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        6⤵
        
        PID:18068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        7⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        7⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        6⤵
        
        PID:18424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        5⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        5⤵
        
        PID:18760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49762.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        7⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        7⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31916.exe
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36958.exe
        5⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        5⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60633.exe
        5⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
        5⤵
        
        PID:19316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55521.exe
        5⤵
        
        PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
      4⤵
      PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        5⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        6⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        6⤵
        
        PID:18272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        5⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        5⤵
        
        PID:17988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      4⤵
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26554.exe
        5⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
        5⤵
        
        PID:19372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
      4⤵
      PID:14892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
      4⤵
      PID:17592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4463.exe
        9⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        9⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        9⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        8⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        8⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        8⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        8⤵
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24017.exe
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        7⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        7⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        7⤵
        
        PID:19072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        8⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        8⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        7⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exe
        7⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        6⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        8⤵
        
        PID:18544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        7⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        7⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        7⤵
        
        PID:17584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        7⤵
        
        PID:14612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20289.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        6⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        7⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        7⤵
        
        PID:18044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        6⤵
        
        PID:18848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        6⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17551.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        8⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        7⤵
        
        PID:18184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        7⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        7⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        7⤵
        
        PID:18804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        6⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        6⤵
        
        PID:18988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41496.exe
        5⤵
        
        PID:14320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        5⤵
        
        PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        6⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        6⤵
        
        PID:18556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        5⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        6⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28064.exe
        6⤵
        
        PID:18976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        5⤵
        
        PID:18116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        7⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        7⤵
        
        PID:17944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        6⤵
        
        PID:18960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        5⤵
        
        PID:18716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28101.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        5⤵
        
        PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
      4⤵
      PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
      4⤵
      PID:17564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe
      4⤵
      PID:18940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57466.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        8⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4416.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        7⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
        7⤵
        
        PID:19016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
        6⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        6⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        6⤵
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        6⤵
        
        PID:18908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        5⤵
        
        PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        8⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        8⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        7⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16668.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        6⤵
        
        PID:17812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        6⤵
        
        PID:19224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        6⤵
        
        PID:17000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        5⤵
        
        PID:17644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
        5⤵
        
        PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33257.exe
      4⤵
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57177.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        6⤵
        
        PID:18724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23364.exe
        6⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        5⤵
        
        PID:18924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        5⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
      4⤵
      PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        5⤵
        
        PID:16940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
      4⤵
      PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
      4⤵
      PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
      4⤵
      PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        6⤵
        
        PID:18932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        6⤵
        
        PID:18952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63100.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        5⤵
        
        PID:19304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        6⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        6⤵
        
        PID:18736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        5⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        6⤵
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
        5⤵
        
        PID:17548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        5⤵
        
        PID:19332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
      4⤵
      PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        5⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        5⤵
        
        PID:17668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
      4⤵
      PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62573.exe
      4⤵
      PID:11016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
      4⤵
      PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
      4⤵
      PID:18864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
      4⤵
      PID:18832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35304.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        5⤵
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10020.exe
        6⤵
        
        PID:19296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        5⤵
        
        PID:18108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        5⤵
        
        PID:17356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
      4⤵
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
      4⤵
      PID:18824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
    3⤵
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe
      4⤵
      PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      4⤵
      PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
      4⤵
      PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
      4⤵
      PID:11972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
    3⤵
    PID:8668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
    3⤵
    PID:12276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
    3⤵
    PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
    3⤵
    PID:4160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        8⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        9⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        9⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        9⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        8⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
        8⤵
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        8⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        8⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        7⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exe
        7⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27081.exe
        7⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        8⤵
        
        PID:17612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        8⤵
        
        PID:19396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62361.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        7⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        7⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
        7⤵
        
        PID:17820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14068.exe
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        6⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        7⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 636
        8⤵
        Program crash
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        7⤵
        
        PID:19320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        7⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10108 -s 468
        8⤵
        Program crash
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        7⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        7⤵
        
        PID:17984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        7⤵
        
        PID:19400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31747.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        6⤵
        
        PID:17728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        6⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
        7⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        7⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        6⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        6⤵
        
        PID:18032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        5⤵
        
        PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        8⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6300.exe
        8⤵
        
        PID:19448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        7⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        6⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52756.exe
        7⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe
        7⤵
        
        PID:19300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        6⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        7⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        7⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23948.exe
        5⤵
        
        PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
      4⤵
      Executes dropped EXE
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        5⤵
        
        PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
      4⤵
      PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        5⤵
        
        PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exe
      4⤵
      PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        5⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        7⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        6⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe
        6⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        5⤵
        
        PID:18648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        5⤵
        
        PID:18696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
      4⤵
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36456.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        6⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        6⤵
        
        PID:19044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        6⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48110.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        5⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        5⤵
        
        PID:18792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        5⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        6⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        6⤵
        
        PID:18736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63320.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        5⤵
        
        PID:19080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
      4⤵
      PID:12592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
      4⤵
      PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
      4⤵
      PID:19440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        5⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        5⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        5⤵
        
        PID:18568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        5⤵
        
        PID:18940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        5⤵
        
        PID:18916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
      4⤵
      PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
      4⤵
      PID:19412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
      4⤵
      PID:18492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        6⤵
        
        PID:17852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52529.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
        5⤵
        
        PID:18748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        5⤵
        
        PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
      4⤵
      PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
      4⤵
      PID:13624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
      4⤵
      PID:17424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
    3⤵
    PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
      4⤵
      PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        5⤵
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
      4⤵
      PID:18888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
      4⤵
      PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
    3⤵
    PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
      4⤵
      PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        5⤵
        
        PID:17512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        5⤵
        
        PID:18896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
      4⤵
      PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
      4⤵
      PID:16732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
      4⤵
      PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
    3⤵
    PID:9980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
    3⤵
    PID:13612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
    3⤵
    PID:17464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5572.exe
    3⤵
    PID:3088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        5⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        7⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32044.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        5⤵
        
        PID:18768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18768 -s 80
        6⤵
        Program crash
        
        PID:19128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        5⤵
        
        PID:19344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        6⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56410.exe
        5⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
        5⤵
        
        PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51733.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        5⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe
        6⤵
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        6⤵
        
        PID:17680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        5⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
      4⤵
      PID:9236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
      4⤵
      PID:12616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
      4⤵
      PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      4⤵
      PID:19028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        7⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        7⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        6⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3186.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        5⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        5⤵
        
        PID:18880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        5⤵
        
        PID:18780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        5⤵
        
        PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        5⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        5⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        5⤵
        
        PID:18632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
      4⤵
      PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        5⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        5⤵
        
        PID:18676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        5⤵
        
        PID:18852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
      4⤵
      PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2174.exe
    3⤵
    PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        5⤵
        
        PID:16708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
      4⤵
      PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
      4⤵
      PID:16952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
    3⤵
    PID:7812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54405.exe
    3⤵
    PID:10940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
    3⤵
    PID:14592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
    3⤵
    PID:18760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10046.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        5⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        7⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        6⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        6⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        6⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        5⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42128.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        6⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        5⤵
        
        PID:18700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
      4⤵
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        6⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        7⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        7⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8215.exe
        5⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        5⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43715.exe
        5⤵
        
        PID:18716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
      4⤵
      PID:18336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe
      4⤵
      PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe
      4⤵
      PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33031.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        6⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        6⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32044.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        5⤵
        
        PID:16884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16884 -s 436
        6⤵
        Program crash
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
      4⤵
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        5⤵
        
        PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
      4⤵
      PID:10988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
      4⤵
      PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
      4⤵
      PID:18892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
      4⤵
      PID:18824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16178.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
    3⤵
    PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exe
        5⤵
        
        PID:17792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        5⤵
        
        PID:19080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
      4⤵
      PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46601.exe
      4⤵
      PID:17340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
    3⤵
    PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
      4⤵
      PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
    3⤵
    PID:8216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
    3⤵
    PID:12572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
    3⤵
    PID:16648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        5⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
      4⤵
      PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
      4⤵
      PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      4⤵
      PID:17412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
    3⤵
    PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33284.exe
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47002.exe
      4⤵
      PID:18636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
      4⤵
      PID:18944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exe
    3⤵
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
      4⤵
      PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
    3⤵
    PID:10272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
    3⤵
    PID:15004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
    3⤵
    PID:17580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
    3⤵
    PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      4⤵
      PID:15380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
      4⤵
      PID:18748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
    3⤵
    PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
    3⤵
    PID:11272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
    3⤵
    PID:15788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
    3⤵
    PID:19372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
    3⤵
    PID:19264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
  2⤵
  PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
    3⤵
    PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
      4⤵
      PID:14408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
    3⤵
    PID:9392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
    3⤵
    PID:13896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
    3⤵
    PID:18288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
  2⤵
  PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
    3⤵
    PID:7884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
    3⤵
    PID:11076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
    3⤵
    PID:14368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
    3⤵
    PID:18968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37510.exe
  2⤵
  PID:4528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe
  2⤵
  PID:10620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
  2⤵
  PID:15424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
  2⤵
  PID:18812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 10108 -ip 10108
1⤵
PID:11912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 7452 -ip 7452
1⤵
PID:13008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10046.exe

Filesize
184KB

MD5
5dd85d6a03c73e241016d233b2545d0f

SHA1
733a13d75c47fc8e145b884a52d9e3d14ba83926

SHA256
50d94651603276f52be7f48b790b09c35530e5916ba30e3cfa1f0e60f2e34d9f

SHA512
4f8b9d3c6feefc489a406617d7b037e6a27f60790c5c59a7f1f784bab023e6169f95170575a12833bceba9561ca526025dd777084174839bcd922130ec341a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe

Filesize
184KB

MD5
df356e5711736ccc3900f9a66d327f6d

SHA1
91efacdf1a0fdba16e3dafeadbebc4a62f5175e5

SHA256
57349697523ecb1d217f37098ad7d585b83b8cfe513e45a9d97b2f20076399e7

SHA512
2ca68ca2e47c10543e95fb1005a415f19fc796c4cdc7ec5930fd23c0325e1cb60ad37e2103ca1394c19f5ab05b25144352c4d8d900199882845fdbd6ba843d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe

Filesize
184KB

MD5
a4269782430e8c598250ec49edeed1c7

SHA1
d1a45e0abd7c21a90344bf72ae0ac90ceb1121a0

SHA256
54649753062f331a533808a6b32bcc0171317ba14f96e43ff21464f58d1dfdb3

SHA512
322d06bf14df7f4f8953b506f1f34ff5ac0406a4c9c00a64d818042b7402e1eabe7045b30766421ea4aaa866a0f140eaf3e6da5ac174e32dd71b051db29454ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19632.exe

Filesize
184KB

MD5
053c7bb92742d73b893f05538a86b48c

SHA1
cda5a288dcd5893a7f00f29cb52aa87cee50f2d2

SHA256
9728f465250d85ce45698c99554ce04d4e9751a78b589b53d42d62bcf70f57c1

SHA512
ce8d496456d20d8be712bce370f4795b72ef1813ffe305d8066a8789c806cc11639b51828b52a22900ef8870f71aaef5178e0c0028752370d4417054b8b573b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe

Filesize
184KB

MD5
55e880f05764a56a588aebd3261f1496

SHA1
f446c8473e0d3fd9c45baea56c368bc0f077237d

SHA256
062d71e0f667b08cf2777409a433ad1477d9bc37492f3d544f8303f2774eeee1

SHA512
fb6204466a296d49cbf9d0fb134b88997fc84c59b8ffa806b1b71b2fc67c67c4e245c8c206fab8d8b0ee184f9f755d5307f042e1d091b27f403c4e031aff00f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe

Filesize
184KB

MD5
9ffc7d76eefb3f09f4f264da5b9983e3

SHA1
767f8bf42ad98f09eec8bc8cf0edf2e73dea9e9e

SHA256
e1c9351fc06b2abad88417a63db065a11b63e73d0afac0215d721065dbac69ba

SHA512
0438d21cad4c041fc43f2fe59b5b4e33517c244b23819bca8c8363e24fef352f3461ea3a22dbcd7e9df302a3b739ceab700b9e5122d60308ed5f4e18fffc8108

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe

Filesize
184KB

MD5
b4a07fc3d1422080b00d36ef164ec06c

SHA1
3bdb5d162053ae516fc2f77ca888b6b08758015c

SHA256
83c8cee47c0c2d4ff073b5a4f6bf617c9b4aaa4c2498ede903a9bddea5a37697

SHA512
208fddae6fd6fed825d5512d8c78e96f7a50f430bb8cd5e8fd16b8bc586b685e77e118f40551acd9970093305d146d380cc2b6942e2dd3f1f96035a04cb056be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe

Filesize
184KB

MD5
65907135f4fdea666160833c73050c82

SHA1
ad02c4bbd2b7b766f122c70b596b4307da0c8847

SHA256
1c6f410fe2bdff3fcf258d09dea50699abd59eebb49d1083625753cf5f99a7ca

SHA512
6777041ae19abfabf0fc804a1f5188e6158cea59e6516896c07a38b18a1fb53d26f3a42e69beb3c89149ed52517b4a2016f938fb6bcb6a3bf6573ffcc463c690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe

Filesize
184KB

MD5
8540271ffaf88f9084d771c6ac09d8ff

SHA1
ee72905a222ee5b6810c0f0b76f2ed82daca8b3a

SHA256
b0fe56358b463ef91a0a07f5fce4ef5e67db465e55da3bcbd47ee1356356826c

SHA512
82952728516b47ccf8d3711c2a521705d2cc15a61ffefbab6ef5cd2de09d07cabd31f08a1d5e6be12f0a110f3841e550d2a326c08fdf3c3d1e758552c7213477

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe

Filesize
184KB

MD5
8074d546d7733b8a0e139d86c403ee68

SHA1
9b6f6fbcba4c49e5113d4036c99f26f7412e3914

SHA256
11ca80ed1fa98968866fc7d111257b86634e2a1ca680f0c7fd96f44e72bced30

SHA512
873daa9cf61051441d5ddca24d9b213310220834f667f51b70ffcfc352b0eff70002846aee47475012d676a69ae1cea65d532542499bc635e7eab859be7cadfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe

Filesize
184KB

MD5
9850b427798050b11b2da2e017ad4539

SHA1
2004f1d764b0137ea970fdbfa1cbdbbef546eca1

SHA256
0cf1d0948349907d30bb3243d26265b002d94616f5484c511f87c50c259a7f7c

SHA512
5cee0fce5b4439b3c7c97151f74ad3e9ccbf8c0d4d1c5b290f53d465ec4e39aac80dd44fc2250eb9317cd90da9d553475f6e4222635cfbc2e8fd736d69edf4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe

Filesize
184KB

MD5
7a42edcce04676bce2e41f0d240b0fac

SHA1
07d9c667bbf29ae3392581c2e11d41e6e239de27

SHA256
2ceb5e870094897e881040184e7a8e41bf72759bf5a292154880ac9e1e7acad3

SHA512
0aa5e0239bf681950ef34357d653f7de3af20540d26f8db2a6a657c0e71fe598569f6694d14de5e96996cbc229a4eca52da081eb88d3084183f449b791ef6acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe

Filesize
184KB

MD5
a1ccd4c483ef086b907e9fdc6cd0cfe4

SHA1
fb7e1b897a7d97319def6e2eef9300584750659d

SHA256
cb1e75cd46507786d050f885323cc2ee3eaa87f1abeb6c234e973de388180586

SHA512
7609c22692d86adda0d27e9a51b84c94028ebfd253b541122a28741d9633ce63d8a68eb48774ec10e62c4c5c4311cb1ddd61b81d349edb9980f31542bc7fd49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe

Filesize
184KB

MD5
ef5e48144eebf3cab1f908791033b435

SHA1
9770eb1f3eb39895f0661c7c916da1c1e58e0a64

SHA256
bfca9e0a0af5525b6376735efee8485c459e46ad49561646844ed51ca97987b5

SHA512
1dc15923f1efe2626d05d1f06f88bbaf54eedff2d10dc18091a9ad7a6b3ac6f46647caa088db62148a75e3a56bb64f6c163813e64ebe2ed89a5fa44eac25180f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe

Filesize
184KB

MD5
a3ab3b3dbfa964ef1c3ee8982a725e56

SHA1
f8525d5e2f04613fceaefeb00f98bd63100f6970

SHA256
584cbce3fb7950716b265aa7a48404852b9704b9d8844bcb1cc884cd85e419a8

SHA512
f1c42a0e2a8babf78d2eb768a9166a861fbeb0a734795f29b7518d3b59a583cec856c2267af002274bfd3151446f18f9469f91b063d959b444dbb3a452bc0ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe

Filesize
184KB

MD5
c510f5a9a89a639134bd908c4b8b2550

SHA1
229cf6ae6dcc61f83b41ca939062c7b8ec261fdf

SHA256
713adb5d76be5d5dac9b93f4124b2e5d9d44dafeb5db8eda9fe15478d8b24977

SHA512
ca49264e17661ccce2204bd279166377e56be0fffb3813cc7e56587924b49c82a3629a045dbc3212c748fb5b81b08b5408b6e3e3b204ec034e53e338a2817c4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe

Filesize
184KB

MD5
96060cbf9b1d926682c2064e59b8e797

SHA1
356583960ca8a2ea45d8b7f5fe20acff1e0e7295

SHA256
4fef72e4b2460bcbf0fd14dbe9c51b7dc119767b3688b3af09f524116c316784

SHA512
21f19f328f7943a003e403a45488b72991aa48088f68eff3a1e6d4967ef5fb6c3b025753049fa75bb17610dfb26697e52490e31fa68c949d1eb13a047ce1feec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe

Filesize
184KB

MD5
4c33a90b43d1a2f51c8c05317d31133a

SHA1
e4a60bf379b0a569c518a2ca826e087986cc9527

SHA256
e2a6fa5e8247946d58629adc1bc210edebfe8868ce0f44ca6b4716d9228740c3

SHA512
510005397ce9568a66535e3627f829cb01d751c12780f8d2ed1b2ac55fcf8d795eb9b49faed610ea5703750efde38f8709e8344ba02d9e7247780d846a74c2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe

Filesize
184KB

MD5
2acf16bd35265c403083ea21c47fb5b0

SHA1
a9877d8f066f73079497c700fa80202eefdc7d74

SHA256
bd3add7288697706141850a5bd3f7878ddd6f295b3b0dfcbdd2e35e19a1457e1

SHA512
323bd2f07c20005437a74b34fd2dbbfed90cc38269b7aa12f47c8d15ffe58366c3982c2ab33c0bad07ad26f8ca74764075e1c79a75c59d9d69acd6f3a9606976

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe

Filesize
184KB

MD5
8a2c029c9bc9cb3fcd2fbc83096ad05d

SHA1
9225cb2e55ae94d3f9da9aeae062b78e1dc61c30

SHA256
b4402e74f0b77d5e45445b6838a49817a32e484be8b92b7115bf3ddfb3df296c

SHA512
6fd69ee22a801963ea16a7d25c1f221b2daeb84d1575dd4355889d64481f9241e315abbdf526b503465efa9a4d90b4c28d0797ccfbc4c56bb12b217415bf7d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe

Filesize
184KB

MD5
9b0cb618dc6dcd457082e8dbe6a771d4

SHA1
97c1ab99df2a5b6571c7f05244cb94d4fc7c822a

SHA256
3aa3d3c841a9a7b0d45457ec0084f20e2877b84503847adc209ea6ee06dbbc48

SHA512
c5ba30c9b35dc706bfe2a7cd96da63f11e7a9a6f5ba1b55993389fd97c3494bc8840e35d16536018f94e64fe07b85e86e87e3eb46d40de44be828bf4623ddfbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53474.exe

Filesize
184KB

MD5
b83aa395a8b1b89ebbc3d318db324800

SHA1
6ae7ab79b895f73dda9123f5649daa76578a55fa

SHA256
8891f315f58e5cf921deda767e165bb75e82bb5773ca29f5e1ae1ce8d361312b

SHA512
9c29f192fb80cfe0e965ca2794d1042f878418c07ba051f7ac08a4fd2b8d02dcb00091fc1aa0a20a7a56bbdbf07189a13a9b25541addafdf413a43255669c983

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe

Filesize
184KB

MD5
552df3155a53df6f231fea1e02e3cebf

SHA1
283369bd18c4357841e66fe116d4540f66b4bab2

SHA256
abdf0ffb978533cdef94486f5fde537446773134a275dece3494b880d29b2269

SHA512
fc162c2badc5cfe4d9fed890d47db27463ab6227c694d9b95e012921b7757943e71a8817b62ca47a34c0b8aff62ab193a25527d13b29691e7f7012c077befcd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe

Filesize
184KB

MD5
3cdc4f945ed70e59e3c7337eabdb5bdb

SHA1
ab09c0ef4e13f88013537caa2244de9820d7562e

SHA256
bcc9dc7163aff92b3adff0ecfd60d54fca36aa72a9afa798b391be50460e2d9d

SHA512
711ca17d5cee57340be8fa76146ffa26d13c8a4665429273f7a44b8116d84fd5f4fe1225cc4d8bfede2ce22d3a13d22dcd7a5d1a6be2153cef18187db0348617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe

Filesize
184KB

MD5
a8364844f9bc4e7953c29e3d88b23578

SHA1
909f63c8f42dba82d9ba21601d9790751647a8a2

SHA256
c413f8a8d45a168a4264c836ffef7da1bbde59768424a4441ee335f64d0347a3

SHA512
47f8750ac43b8b5aa8684f38c7e34f98a6561eaae787da8ed1cec59ebdce9748d6c1ec79e100ac0533ea33a3f1578c43f979fb91c21838e1bf2a4109f7785e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57466.exe

Filesize
184KB

MD5
5132211f4316a5726d6e48fc65b06dd6

SHA1
15bbb819e07d52d646e64657f8d13f8ba3dcf975

SHA256
8e4b82f052fe74cbbb8a87771ba9ba9091a2ad76b524505f54491dfdfc01c2a2

SHA512
568fd35dc5a9f09d28ef28f48eb9b87381d7f821bff1677826eb2b13381835af9492221025825f5e10e1cf113eed192bb49024ea5c0eee064df0421f04a4cd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe

Filesize
184KB

MD5
633d1d3dd55abec223ab9d056bc250a8

SHA1
9c117d716daf80f52f1225beb79ecf25d648b507

SHA256
10de2188622eba56b3a940dab86fa8450ba3bef990c485121ea977501fb1ccb1

SHA512
e9f35e17c276e982363d1ced8647146f8c872d40e75d1a7f6db6cc214d0fe7aeaec9f51a1cee0f91c8d8720e51815a1a784355625fb5aac26a0e383eeb431b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe

Filesize
184KB

MD5
780121ce6eb4d2f07e7291343099a8d0

SHA1
da8765982e94d6a9f3cd50298d87fa600067e14d

SHA256
6b59ca8eb3cb8f07250021fb3cb2b1e8ea7a02501fcdc59539bca23eae1ad861

SHA512
5e0fea42127077c90a9ac3097adb631994e4860092d76535b65b0c6878bcac4ce3bf5b280947ae25275ff9b42d64edcf7b98ce2afb73ff1cbb8136001c1d1e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62361.exe

Filesize
184KB

MD5
3f0a22356c4c4d3311cd33fa9802deae

SHA1
26ab9c0a631874097dac46e6cfb0a86b72854112

SHA256
57a324b058f168b8348973e9391f9345704854a8584473f8b1e87a36ac811cb6

SHA512
6364b56792407a4ac431cc48b7247e6de52db942508c01cfb53088ec11703b68406c67426fe558b5154512c6c12e5032ada0d212bf06e939bed05360eb5f76c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe

Filesize
184KB

MD5
03580adc4820464df4997cab5d8d2f51

SHA1
dcda14422c58dae968de7f77d7902099ff957bd8

SHA256
d949743d6e3a7ac075d3835c981504846411e5779d840d6563e7c65348b704c0

SHA512
ab58284967ebfa779a5a305e1b883e7670d0aa09a77ef43264f46cb006b8dc05e41b8f7ad1687f3a42509166f4f562f3341eba06fe72aebb32f43281f2759034

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe

Filesize
184KB

MD5
312156519714ec76decb4677cbb4358e

SHA1
7f403c4f22d51b8af4a7f1e49b6b14a6ebc0e9ae

SHA256
f8ef6a743292f7eca65b61d4bba9cdac0e2467b1c105b0ed4aa9fa5e4646e4a5

SHA512
5db82cb9120bec427ff239c9dc1e3a261dcc45fd55b6e0df74357de70a2b07807ccbd134e9dc006d0d031aaa06f215c76eb3b7da3db011ee84460fef8eb5fd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe

Filesize
184KB

MD5
aafdbc37effd5bcd9fc443513ceeb157

SHA1
c9d7a343aa2be6f7a1e7303c738f4eaf6c2a5a1f

SHA256
e5a0f2a9d1a0b1ba7edc905709f9b552a0981ce697f42b88ed64d81a69895efb

SHA512
90ec8fe3ea4d359073835e9817ea39b16775f9ab5b3cb6fdd38b2360125e8371e322f821e7a4ba56fa3497d7d4abc6341db3a230c243a6e6e2be05cb0c8195c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe

Filesize
184KB

MD5
0c47d5c46bf5c9185f51a212d55b4d15

SHA1
3d5854eafba21c5bba0e40296c7ff79bb40b6bdd

SHA256
896b19ead81385e53f5ea00e4846f5f96a0d74263965f8c849bda914071a5a4a

SHA512
f8a3457ba2d93582a27bf60f961bff2b65ec7e498fe2b6448fe1ee5465eacff4f7175e96dc5790de7d5bc617f2a9731f899d54a677a03fc165e0fbfb144ebeed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe

Filesize
184KB

MD5
f774e781f643d77f0ed09e70f5f5414a

SHA1
a5b4909a7ad2d437677333ced7f0680afb34c234

SHA256
d7a5471a8fc1335a6dfc5b1d043138cd29cd4403d60194c79bdf8fb9d0ce21fb

SHA512
7b8a9d0f6223b78df8c48a7726f42641cfcde7348d58a2651fd321711c29d20dd96321b39625f0edc2a52170895cc4665b8757cfacb8de69ee0c803a5732d671

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads