4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22

Analysis

max time kernel
149s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe
Size

184KB
MD5

7e0986658aa513f8aade5f518a18fad2
SHA1

882d5cbbfe8df2e884115459b54ae63d912da319
SHA256

4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22
SHA512

a4c62c88b7196048c1c3e0df8ddf89a8265466208daa628fdbc2d52a4c5aa7a3707b1e8b789abbc4c6738521531762117980b8454e00ac173b5936b351bae791
SSDEEP

3072:gU3sbfon57vsdQDhWkVNA+GYlvnq4Xium:gUQoNYQDvNjGYlPq4Xiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3236	Unicorn-35102.exe
3172	Unicorn-44977.exe
2792	Unicorn-64842.exe
2480	Unicorn-45346.exe
380	Unicorn-21396.exe
2228	Unicorn-41262.exe
732	Unicorn-14711.exe
4164	Unicorn-10317.exe
3908	Unicorn-35568.exe
3304	Unicorn-63602.exe
2528	Unicorn-18577.exe
2860	Unicorn-59518.exe
1164	Unicorn-38641.exe
548	Unicorn-19040.exe
3636	Unicorn-59518.exe
3960	Unicorn-23813.exe
3116	Unicorn-60670.exe
3848	Unicorn-50919.exe
4000	Unicorn-971.exe
1816	Unicorn-971.exe
4040	Unicorn-971.exe
780	Unicorn-971.exe
4932	Unicorn-35782.exe
860	Unicorn-971.exe
4988	Unicorn-28168.exe
1532	Unicorn-3009.exe
2396	Unicorn-209.exe
4668	Unicorn-8874.exe
3096	Unicorn-54811.exe
2872	Unicorn-55600.exe
3532	Unicorn-51251.exe
1296	Unicorn-33042.exe
1536	Unicorn-28958.exe
1248	Unicorn-2215.exe
2100	Unicorn-54017.exe
5108	Unicorn-38972.exe
2368	Unicorn-21174.exe
2348	Unicorn-1308.exe
5052	Unicorn-64152.exe
3152	Unicorn-64152.exe
1240	Unicorn-44716.exe
856	Unicorn-61252.exe
1712	Unicorn-4380.exe
428	Unicorn-64052.exe
3184	Unicorn-64052.exe
972	Unicorn-50317.exe
4108	Unicorn-48179.exe
780	Unicorn-25620.exe
3592	Unicorn-25620.exe
4912	Unicorn-35926.exe
1064	Unicorn-46254.exe
3624	Unicorn-12819.exe
1572	Unicorn-21750.exe
2884	Unicorn-14136.exe
1624	Unicorn-14157.exe
432	Unicorn-514.exe
4452	Unicorn-55190.exe
2520	Unicorn-32632.exe
4816	Unicorn-63093.exe
760	Unicorn-63358.exe
3872	Unicorn-57228.exe
2352	Unicorn-22880.exe
4040	Unicorn-38662.exe
2256	Unicorn-50649.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
1348	860	WerFault.exe	116
2268	4040	WerFault.exe
3620	1816	WerFault.exe
3908	780	WerFault.exe
6608	6208	WerFault.exe	245
7468	5712	WerFault.exe	195
9164	6788	Process not Found	1044
11196	6492	Process not Found	1064

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6400	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18852	Process not Found
Token: SeChangeNotifyPrivilege	18852	Process not Found
Token: 33	18852	Process not Found
Token: SeIncBasePriorityPrivilege	18852	Process not Found
Token: SeCreateGlobalPrivilege	10492	Process not Found
Token: SeChangeNotifyPrivilege	10492	Process not Found
Token: 33	10492	Process not Found
Token: SeIncBasePriorityPrivilege	10492	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe
3236	Unicorn-35102.exe
2792	Unicorn-64842.exe
3172	Unicorn-44977.exe
2480	Unicorn-45346.exe
380	Unicorn-21396.exe
732	Unicorn-14711.exe
2228	Unicorn-41262.exe
4164	Unicorn-10317.exe
3636	Unicorn-59518.exe
2528	Unicorn-18577.exe
2860	Unicorn-59518.exe
3304	Unicorn-63602.exe
1164	Unicorn-38641.exe
548	Unicorn-19040.exe
3960	Unicorn-23813.exe
3116	Unicorn-60670.exe
3848	Unicorn-50919.exe
4932	Unicorn-35782.exe
4988	Unicorn-28168.exe
1532	Unicorn-3009.exe
3096	Unicorn-54811.exe
4668	Unicorn-8874.exe
2396	Unicorn-209.exe
2872	Unicorn-55600.exe
3532	Unicorn-51251.exe
1536	Unicorn-28958.exe
1248	Unicorn-2215.exe
1296	Unicorn-33042.exe
2100	Unicorn-54017.exe
5108	Unicorn-38972.exe
3152	Unicorn-64152.exe
2368	Unicorn-21174.exe
2348	Unicorn-1308.exe
5052	Unicorn-64152.exe
1240	Unicorn-44716.exe
972	Unicorn-50317.exe
1712	Unicorn-4380.exe
428	Unicorn-64052.exe
3184	Unicorn-64052.exe
856	Unicorn-61252.exe
4108	Unicorn-48179.exe
780	Unicorn-25620.exe
4912	Unicorn-35926.exe
3592	Unicorn-25620.exe
1064	Unicorn-46254.exe
1572	Unicorn-21750.exe
3624	Unicorn-12819.exe
2884	Unicorn-14136.exe
1624	Unicorn-14157.exe
432	Unicorn-514.exe
4452	Unicorn-55190.exe
4816	Unicorn-63093.exe
2352	Unicorn-22880.exe
2520	Unicorn-32632.exe
760	Unicorn-63358.exe
4040	Unicorn-38662.exe
3872	Unicorn-57228.exe
2256	Unicorn-50649.exe
3200	Unicorn-45439.exe
4404	Unicorn-45439.exe
3980	Unicorn-45439.exe
3132	Unicorn-63706.exe
4344	Unicorn-30302.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3236	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	86
PID 4840 wrote to memory of 3236	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	86
PID 4840 wrote to memory of 3236	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	86
PID 4840 wrote to memory of 3172	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	91
PID 4840 wrote to memory of 3172	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	91
PID 4840 wrote to memory of 3172	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	91
PID 3236 wrote to memory of 2792	3236	Unicorn-35102.exe	92
PID 3236 wrote to memory of 2792	3236	Unicorn-35102.exe	92
PID 3236 wrote to memory of 2792	3236	Unicorn-35102.exe	92
PID 2792 wrote to memory of 2480	2792	Unicorn-64842.exe	94
PID 2792 wrote to memory of 2480	2792	Unicorn-64842.exe	94
PID 2792 wrote to memory of 2480	2792	Unicorn-64842.exe	94
PID 3236 wrote to memory of 380	3236	Unicorn-35102.exe	95
PID 3236 wrote to memory of 380	3236	Unicorn-35102.exe	95
PID 3236 wrote to memory of 380	3236	Unicorn-35102.exe	95
PID 3172 wrote to memory of 2228	3172	Unicorn-44977.exe	96
PID 3172 wrote to memory of 2228	3172	Unicorn-44977.exe	96
PID 3172 wrote to memory of 2228	3172	Unicorn-44977.exe	96
PID 4840 wrote to memory of 732	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	97
PID 4840 wrote to memory of 732	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	97
PID 4840 wrote to memory of 732	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	97
PID 2480 wrote to memory of 4164	2480	Unicorn-45346.exe	100
PID 2480 wrote to memory of 4164	2480	Unicorn-45346.exe	100
PID 2480 wrote to memory of 4164	2480	Unicorn-45346.exe	100
PID 2792 wrote to memory of 3908	2792	Unicorn-64842.exe	101
PID 2792 wrote to memory of 3908	2792	Unicorn-64842.exe	101
PID 2792 wrote to memory of 3908	2792	Unicorn-64842.exe	101
PID 380 wrote to memory of 3304	380	Unicorn-21396.exe	102
PID 380 wrote to memory of 3304	380	Unicorn-21396.exe	102
PID 380 wrote to memory of 3304	380	Unicorn-21396.exe	102
PID 3236 wrote to memory of 2528	3236	Unicorn-35102.exe	103
PID 3236 wrote to memory of 2528	3236	Unicorn-35102.exe	103
PID 3236 wrote to memory of 2528	3236	Unicorn-35102.exe	103
PID 2228 wrote to memory of 2860	2228	Unicorn-41262.exe	104
PID 2228 wrote to memory of 2860	2228	Unicorn-41262.exe	104
PID 2228 wrote to memory of 2860	2228	Unicorn-41262.exe	104
PID 732 wrote to memory of 3636	732	Unicorn-14711.exe	105
PID 732 wrote to memory of 3636	732	Unicorn-14711.exe	105
PID 732 wrote to memory of 3636	732	Unicorn-14711.exe	105
PID 4840 wrote to memory of 1164	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	106
PID 4840 wrote to memory of 1164	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	106
PID 4840 wrote to memory of 1164	4840	4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe	106
PID 3172 wrote to memory of 548	3172	Unicorn-44977.exe	107
PID 3172 wrote to memory of 548	3172	Unicorn-44977.exe	107
PID 3172 wrote to memory of 548	3172	Unicorn-44977.exe	107
PID 2792 wrote to memory of 3960	2792	Unicorn-64842.exe	108
PID 2792 wrote to memory of 3960	2792	Unicorn-64842.exe	108
PID 2792 wrote to memory of 3960	2792	Unicorn-64842.exe	108
PID 4164 wrote to memory of 3116	4164	Unicorn-10317.exe	109
PID 4164 wrote to memory of 3116	4164	Unicorn-10317.exe	109
PID 4164 wrote to memory of 3116	4164	Unicorn-10317.exe	109
PID 2480 wrote to memory of 3848	2480	Unicorn-45346.exe	110
PID 2480 wrote to memory of 3848	2480	Unicorn-45346.exe	110
PID 2480 wrote to memory of 3848	2480	Unicorn-45346.exe	110
PID 2860 wrote to memory of 1816	2860	Unicorn-59518.exe	112
PID 2860 wrote to memory of 1816	2860	Unicorn-59518.exe	112
PID 2860 wrote to memory of 1816	2860	Unicorn-59518.exe	112
PID 3304 wrote to memory of 780	3304	Unicorn-63602.exe	114
PID 3304 wrote to memory of 780	3304	Unicorn-63602.exe	114
PID 3304 wrote to memory of 780	3304	Unicorn-63602.exe	114
PID 3636 wrote to memory of 4040	3636	Unicorn-59518.exe	113
PID 3636 wrote to memory of 4040	3636	Unicorn-59518.exe	113
PID 3636 wrote to memory of 4040	3636	Unicorn-59518.exe	113
PID 1164 wrote to memory of 4000	1164	Unicorn-38641.exe	111

C:\Users\Admin\AppData\Local\Temp\4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe
"C:\Users\Admin\AppData\Local\Temp\4550844e458d7056f3fc2fc54dc967fffcb4bd243d9bb318839f3df135283b22.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10317.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        9⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        10⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        10⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        10⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        10⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
        9⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
        9⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        9⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        9⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        9⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        9⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        9⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4370.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14258.exe
        8⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58636.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        9⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        10⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        10⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        10⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        10⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        9⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        9⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        9⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        9⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        9⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        9⤵
        
        PID:16448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54804.exe
        9⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        8⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        8⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28076.exe
        8⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
        9⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        9⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        9⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
        8⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        7⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        9⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12101.exe
        9⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        9⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        9⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
        8⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        9⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        9⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        8⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        8⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        9⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        9⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        9⤵
        
        PID:18288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        9⤵
        
        PID:18692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        8⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        8⤵
        
        PID:18244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16675.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21912.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28387.exe
        7⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        8⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        8⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        8⤵
        
        PID:18232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        8⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        8⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        8⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        8⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51077.exe
        8⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34846.exe
        7⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        6⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        7⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
        7⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        6⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        6⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        9⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        9⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        9⤵
        
        PID:17580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        8⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        8⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        8⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        9⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        9⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        8⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
        8⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        8⤵
        
        PID:18260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11632.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        7⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        8⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        9⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        9⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
        9⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
        9⤵
        
        PID:18668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        8⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
        8⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
        8⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3959.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe
        7⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        7⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        7⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        6⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        9⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        9⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        9⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39236.exe
        9⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37408.exe
        8⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        8⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        8⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exe
        7⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
        7⤵
        
        PID:17912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        8⤵
        
        PID:18280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exe
        8⤵
        
        PID:18228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65394.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        7⤵
        
        PID:18132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37560.exe
        7⤵
        
        PID:18660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        6⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6781.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        6⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58034.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        8⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        7⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        7⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        7⤵
        
        PID:18524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        7⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        7⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        6⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17732.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
      4⤵
      Executes dropped EXE
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23813.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9413.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        7⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        7⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        7⤵
        
        PID:17512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        8⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        7⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        7⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29187.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8780.exe
        7⤵
        
        PID:18512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7110.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        8⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        8⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        7⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        7⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        7⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
        7⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
        7⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        7⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61681.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        6⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        6⤵
        
        PID:18624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
        5⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        5⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
        5⤵
        
        PID:18436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        6⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 720
        7⤵
        Program crash
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12102.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        7⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        6⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14326.exe
        7⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6951.exe
        7⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        6⤵
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41214.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        5⤵
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        7⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        6⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        5⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
        6⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        6⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        6⤵
        
        PID:18476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        5⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        5⤵
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        5⤵
        
        PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        5⤵
        
        PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
      4⤵
      PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
      4⤵
      PID:18544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        5⤵
        Executes dropped EXE
        
        PID:780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 212
        6⤵
        Program crash
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14313.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48919.exe
        8⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        8⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
        8⤵
        
        PID:18592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        8⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
        7⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
        6⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34825.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        6⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        7⤵
        
        PID:18028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
        6⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        6⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11657.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exe
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19140.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        8⤵
        
        PID:18684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38552.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        7⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        7⤵
        
        PID:18676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36030.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        7⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        6⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        7⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        7⤵
        
        PID:17420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        6⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        6⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        5⤵
        
        PID:17448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        5⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        6⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        5⤵
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
      4⤵
      PID:14480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
      4⤵
      PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
      4⤵
      Executes dropped EXE
      PID:860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 176
        5⤵
        Program crash
        
        PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
        7⤵
        
        PID:17428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        7⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30656.exe
        6⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
      4⤵
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        6⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        6⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        5⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
      4⤵
      PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
      4⤵
      PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
      4⤵
      PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
      4⤵
      PID:18604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        8⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42532.exe
        7⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
        7⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        6⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37771.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        7⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26387.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      4⤵
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        5⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        5⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63843.exe
        5⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        5⤵
        
        PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe
      4⤵
      PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4007.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        5⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        5⤵
        
        PID:15224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        5⤵
        
        PID:14704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
      4⤵
      PID:13448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      4⤵
      PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
      4⤵
      PID:18652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
    3⤵
    PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      4⤵
      PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
      4⤵
      PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
      4⤵
      PID:17760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
      4⤵
      PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
    3⤵
    PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
      4⤵
      PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
      4⤵
      PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
      4⤵
      PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
    3⤵
    PID:13060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
    3⤵
    PID:17136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
    3⤵
    PID:18508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        5⤵
        Executes dropped EXE
        
        PID:1816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 212
        6⤵
        Program crash
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20536.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        8⤵
        
        PID:18580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        7⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        7⤵
        
        PID:17500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        6⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        7⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        6⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        8⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        7⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        6⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        7⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        7⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16941.exe
        6⤵
        
        PID:18456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
        5⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        7⤵
        
        PID:17068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64042.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        6⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        7⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59543.exe
        6⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        5⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59881.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        7⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        7⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        6⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        6⤵
        
        PID:16792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        6⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        5⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        5⤵
        
        PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        5⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32822.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        6⤵
        
        PID:18004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        5⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
      4⤵
      PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
      4⤵
      PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        7⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        7⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        7⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        6⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
        7⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
        6⤵
        
        PID:17988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe
        5⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        5⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        5⤵
        
        PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
        5⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        6⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        6⤵
        
        PID:13896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        5⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        5⤵
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        5⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        5⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        5⤵
        
        PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        5⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
      4⤵
      PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      4⤵
      PID:18348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
      4⤵
      PID:18244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        8⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        7⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15042.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
        6⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        6⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        7⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
        6⤵
        
        PID:17932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        5⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
      4⤵
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        7⤵
        
        PID:17448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        6⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        6⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        5⤵
        
        PID:16884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
      4⤵
      PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54692.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        5⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        5⤵
        
        PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
      4⤵
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
      4⤵
      PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34801.exe
      4⤵
      PID:18116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18881.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48966.exe
        6⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57131.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46371.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        5⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        5⤵
        
        PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
      4⤵
      PID:6208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 408
        5⤵
        Program crash
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58868.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
      4⤵
      PID:15312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
    3⤵
    PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
      4⤵
      PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25606.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        5⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        5⤵
        
        PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
      4⤵
      PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
      4⤵
      PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48807.exe
      4⤵
      PID:10004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
    3⤵
    PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
      4⤵
      PID:15788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
      4⤵
      PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
    3⤵
    PID:12844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
    3⤵
    PID:16932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54319.exe
    3⤵
    PID:8172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
      4⤵
      Executes dropped EXE
      PID:4040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 212
        5⤵
        Program crash
        
        PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        7⤵
        
        PID:17880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        6⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49429.exe
        6⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
        5⤵
        
        PID:18324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
        5⤵
        
        PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        5⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        5⤵
        
        PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
      4⤵
      PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
      4⤵
      PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      4⤵
      PID:18356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
      4⤵
      PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        7⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        7⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40096.exe
        6⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        6⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        5⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        5⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21588.exe
        5⤵
        
        PID:18388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        5⤵
        
        PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
      4⤵
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        5⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        6⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        5⤵
        
        PID:18208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe
      4⤵
      PID:13664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
      4⤵
      PID:17452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        5⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        6⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        6⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
        5⤵
        
        PID:17776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        5⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9958.exe
        5⤵
        
        PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
      4⤵
      PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
      4⤵
      PID:13920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      4⤵
      PID:18316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
      4⤵
      PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exe
    3⤵
    PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
      4⤵
      PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
      4⤵
      PID:13888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
    3⤵
    PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
      4⤵
      PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      4⤵
      PID:17216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
      4⤵
      PID:18568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
    3⤵
    PID:13136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
    3⤵
    PID:15596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
    3⤵
    PID:6984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
    3⤵
    - Executes dropped EXE
    PID:4000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        5⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        6⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        5⤵
        
        PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
      4⤵
      PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        5⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        5⤵
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        5⤵
        
        PID:18096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
      4⤵
      PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
      4⤵
      PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6788.exe
      4⤵
      PID:18532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
    3⤵
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42532.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
      4⤵
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36231.exe
      4⤵
      PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
      4⤵
      PID:3100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
    3⤵
    PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39817.exe
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
      4⤵
      PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
    3⤵
    PID:8396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
    3⤵
    PID:12252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
    3⤵
    PID:16248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
    3⤵
    PID:4408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-209.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-209.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        5⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27512.exe
        6⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        6⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        5⤵
        
        PID:17992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49813.exe
        5⤵
        
        PID:18556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
      4⤵
      PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
      4⤵
      PID:11036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
      4⤵
      PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
      4⤵
      PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18079.exe
    3⤵
    PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
      4⤵
      PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        5⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        5⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        5⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54804.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
      4⤵
      PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
      4⤵
      PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
      4⤵
      PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
    3⤵
    PID:7208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36135.exe
    3⤵
    PID:10644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe
    3⤵
    PID:15076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8163.exe
    3⤵
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
    3⤵
    PID:5860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
    3⤵
    PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38792.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        5⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9469.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
      4⤵
      PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
      4⤵
      PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
      4⤵
      PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      4⤵
      PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
    3⤵
    PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      4⤵
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        5⤵
        
        PID:14712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
      4⤵
      PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      4⤵
      PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
      4⤵
      PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
    3⤵
    PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
    3⤵
    PID:11340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
    3⤵
    PID:15476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
    3⤵
    PID:6348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28472.exe
  2⤵
  PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
      4⤵
      PID:12532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      4⤵
      PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
      4⤵
      PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
    3⤵
    PID:10072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    3⤵
    PID:13992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
    3⤵
    PID:17768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
    3⤵
    PID:18380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
  2⤵
  PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
    3⤵
    PID:10408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
    3⤵
    PID:14720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
    3⤵
    PID:17820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32822.exe
    3⤵
    PID:18148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
  2⤵
  PID:9452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
  2⤵
  PID:13072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
  2⤵
  PID:15200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 860 -ip 860
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 780 -ip 780
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4040 -ip 4040
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1816 -ip 1816
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4000 -ip 4000
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6208 -ip 6208
1⤵
PID:6572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5712 -ip 5712
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:6400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10317.exe

Filesize
184KB

MD5
edd3fcdfc4ea04813057d43e3594dab0

SHA1
43452cc237e4db2ef00778dfa6c783a5520d9189

SHA256
1b37d5fd57efa7d7510ea478d1382aea34db1b5d09f56a9753a941b6b647aab8

SHA512
6462058b941d9bc6b8ea549ab6f80033b62779128973a90f2b3bd536e22d08202b34b1fa1c6f41de4ebc3c22fcb3eca7d16798ff16267066d14c0c9bc2282180

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe

Filesize
184KB

MD5
1bda37166e916b4806b7936f56188eef

SHA1
1f157b404e67e9ac980e25105e7f6755782bcfdc

SHA256
19db52310030cbbc90ec761611db4999612577f23a0d129e073614ab8bc472d9

SHA512
966abe5aaf1d5f1bc1dcf189b77ce1c5a5f1bed3fb2e5c2df507c021f23e19f3eadeeeea18ae83d7f522fcf0ed1257c443e2dc6af277a2dec4d728cec45e00be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe

Filesize
184KB

MD5
a6b45481ab773ebf0e9003dd95a8d0a2

SHA1
2843cb70b8b95c046a6576310bb612943eeb0ef6

SHA256
492fb1475691ad5fdbf050b315fcb35441d0fa8dce4cb1ca0d671b16080a2eb8

SHA512
eef74dc5290d90e806a960b563d8d62ee1c057f4ba253817a1739a45c7dce2fcb53d728e8781c6b8590921c964613c4fdf5ea702cc0a7c0d4ea236d8586e5ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe

Filesize
184KB

MD5
91bf130cdd9883db9bc5e89e79a2231b

SHA1
8099745c5d6ea8329aa28ba8540e66f0f9a09a7c

SHA256
7ccdd27f9409e7ffe810fbafbc589f2a4879b266e280ddab026f5dadc33b5947

SHA512
990f25e57d809353739b4d12f5213430eb006966bd35ae3084f95211c72baa7cacd24e7db79cce8b2b478ba6b8daddd6ba541b61d850ae6899a21d9b285c108b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-209.exe

Filesize
184KB

MD5
32bb9b446213f340b90ba33dc2d9a0d2

SHA1
77a7de52774ffb8f4b1635df8d42a302e369e18c

SHA256
89a847c8b3929b2303a859b2868d1af58993ec621674f435d373762a52f399e8

SHA512
7d53fab5b45d3c8deec942c74cef0f6a32c199581e139e479f507b9d8f92ab1b9d20b921633573f79d07c7e5d59f61bef8e1eec2419e750ad3759e91cf63868a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe

Filesize
184KB

MD5
0a2faa5948e6bff41613c283ee95476a

SHA1
8b534eb3d2eb489371ae1188efe31a2cc84490b5

SHA256
744db88da85e755e8f004ac11e09cb257e91c96200f9283cd37d02f8f1e6de89

SHA512
741aa103de6dbe27f87103fcab4605c76bf46c2b893ad657bf3931bd56463c52c6045ae8263fad8310064eb370d08cea6a2bb935bbfab52cca491be0449c8ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe

Filesize
184KB

MD5
0d37a9a2ecceb10877cc34e74b088687

SHA1
9b9b06dc65c1a6d7a72516d125656206ddc24403

SHA256
a467327043b3a8dfca15166e1045b873f9f6789f23a939e3fbe368898bc84ddb

SHA512
befe3ad263a5bf1872f84d3fb3edb3bfd00218c7e049f5413018c02214a926b7c07c9da1f418a399eb49c14a65bb201ec49791c313eef9a60589ae8c740647b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe

Filesize
184KB

MD5
bd401346ff2b40b17678f4e84ddb5afe

SHA1
0b797a870e1ceaa1aef3244f1054d6de3b12a2bf

SHA256
01af57989eeb326cb72cabfb29a0f5aece8acfc8f11ec64e7cfa027e7679bd56

SHA512
ca8a799914586be3ed905b2cb89b0af4c1c0cd600e793290c4a50990b643baec9a2efc5d91024f049d2c93dd108b00250d00e7b1bacccdd743a8775d94f645d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23813.exe

Filesize
184KB

MD5
b3d51018540a0e0dfbf23a6860a8ab3c

SHA1
f95e2cfce54c66eeac3dfd7f817c5e09b32a4759

SHA256
439edaa2ad2e925538e81a8554b33cd6c12a348e9b60e88be462c05a321b4bab

SHA512
fa624e823b1f124451fa50809b7ef12a281b7aa227814a65587ea14bc81ebe88b72ac8c483fce06ed4a2df414eafc491331964dc3e7c2fea9959e1d905433a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28168.exe

Filesize
184KB

MD5
b4ca0c3b5925e65fdf9e892417de9078

SHA1
0a6d726242519c5d3fba56039faf7bbcb787fd40

SHA256
4e6400a5a1b051f7204abe969a3278f825fad0863094a4a10a2f4a2d47e1553d

SHA512
3e4624a0556c2941bbbbd1285a9856ca19266c14564c8d7b26c7eefcea9f80eaec3b59fc9b3c544ad20424696ac9b41a6fa445352b82f20f810be8c3692295a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe

Filesize
184KB

MD5
6b3c0ddc18e1becc72a3a56678036d2b

SHA1
985bab56e28ec2e628b9aed91e7f986c3628067f

SHA256
dede463d79c872c0f70f7a9b67ed92777acf14d173578d9fdc537a5c37937f7b

SHA512
753cd9c6470f83122df417fcf4b8ee55c870bb16b982ca33cadf80d2288bac62cd6947c02ad20b8856494f2c7027cfa3c2748108270b13cbd23764a6327c2854

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe

Filesize
184KB

MD5
f5a4a8246fa9d9c44a3d0c185fb2b0f7

SHA1
b102d53ee70d73673b5d96ff792c5dcea0b2bc12

SHA256
6fe59d91bb334362bb73785ae697d636087ba0c2e26068ac8149a215d303197d

SHA512
ae3fefefedd5e26f478b8fb6f6c3d2f42238acd076cd5a423e7879bba00506fdcd3573cf95122176d42e7349b9e4c38b1658de1c302eeccc430a0b02bb7d08dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe

Filesize
184KB

MD5
deeccb9c99c70fc3c693493ac87de988

SHA1
4312509eca0d27c8d778c33061cdbd8ba4dc54b4

SHA256
e04f9d31610108a5da08c8f465bc02b7794c2fe995465021b4e475019a759c19

SHA512
421352a9d9389be29404d092d53782e4e468b31bf31edb92ed277557b92d96c252ad79c1bab7d6b2c5e38b27342c599c43711a3d0368294bd68de493563e5472

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe

Filesize
184KB

MD5
f6db5ce1f2bf806271bb8b6b59c90d95

SHA1
8ee78d73bf248cdeb7ce22b76e3dcdeb4b04af79

SHA256
b018a799e7c28672ec463ff0cfd02fd7ded8537fd0a0af4fd4dfa016565062ff

SHA512
592c33e657a69eed8f1eba168c87a6633f60389f63f730168359ecf34ecd33e911ffc99e5c1d5ba9a44d0c95884b590bd3b66f88019129dd0ae593eda911e1e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe

Filesize
184KB

MD5
4ec384ed76a5a9c662b39ab5d12e0c56

SHA1
6cdd24e11d93cffed2c0f6ededbc0530ec61d278

SHA256
7e7ac2ab7ddc8bbec3a3122a52be836eb8250abdcb9c890ab3f652cd53fc4d99

SHA512
3792597feb6e169b60b0b2891e760dbef9fb15ba2f183657192523889ac2fd664e15ce9641c374b61b7117e515fa8f2880b58c904affec1dd72811f98007dc92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe

Filesize
184KB

MD5
da6afa5d018e225279b113e89c94ba53

SHA1
42b135bf64ecd7b915f60e2fd51456305efe170b

SHA256
0ae5f4697b0a506f76bc840841349361d40046b4b17ffc891dcaea31296ab1f9

SHA512
eb23526bb5225a8a00ea1db06001e62cbb3665c633de08403a5c346c1fc7c855dc66f364231aa57d22c2163dc0b7568cbb718e9f3519b0f621f71d6b2877a732

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe

Filesize
184KB

MD5
a7d109362b9779a4116f6de624194bd3

SHA1
0d7294eaa37440bb9ae9319d23727b17a2abe75c

SHA256
6dff2f2f519f5e0b4b596eb715fe4367b366097ecd172b56cd1fb6dd30533ef2

SHA512
7452961f3bba25c1a0dd67897293c32b8621eeca5cef62d680dd5333ece88ae55803b9e3526bfa63caa59452f529186c35a5504492d20d2851c4d42ee4461496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe

Filesize
184KB

MD5
3dd72aa07d538c6f4ddb6479a159ace3

SHA1
f411a8e9ab5000b6351887829934c798c05ee450

SHA256
8a1f19238943ab767af664a6e51fd75a0fcca1bcd627ed334dffac20b0b4023a

SHA512
e0984f642088cdc26905fb8737b222fe6174e1c4f8c52dfd00bc786f3f15bd32853c94d9b11f7298f4bcc26577bfc6c3d1837c7c12683653889c3c1d5d383674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39783.exe

Filesize
184KB

MD5
2535e7f5724624e1f558b4a55f5f052b

SHA1
32befe981cbbad86bdd20de6aae5274a13d14600

SHA256
b26b5909b6b7b68c80c10ddd14591092974c3931861ff9d49a056e239a9ced67

SHA512
179283fb110f9784a07b7e52470743acccc1d3f07afa0efc8a12f03358e8a09f5b7dac5cf52f0ca0107f06545dd2a199016a493da69144eb976823102670f5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe

Filesize
184KB

MD5
4c4e5b3de7be606b3a58efa8aac9d33b

SHA1
c1314aa0f6429cd2cdb86a245359056156e2ef60

SHA256
6e82dd6bafff797ba3c0e890aeff7b47bb7aa84bbcc03adc01dab36a42d0333e

SHA512
53146cfeef25ee567be782c8ca938d6b3a1b56d23228b706addefa24c674e9e6715d033715d5c59f687666acdb69542df173311b7951f58c24b14f72fc545f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe

Filesize
184KB

MD5
5320e9b6d9f5f0481b5e2d9480ea43a3

SHA1
768319d1e7581b265187b119ea97d3a092056c52

SHA256
bd0939284b7b758316e5aadc442a36e61be62e6aacc1b672638ab749ee09a90d

SHA512
038afdd446d4cb5bb447e353970e09085266cb785a9520acb9fc44e9039e1fde506838885ea045f7af776e1fa9b7cf9d0d60416f3d1cc3b07a87f9d115db199e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe

Filesize
184KB

MD5
ed99fa5cb4684c2ac0ac054e951472c4

SHA1
6a7ae07a5f9dfdd8ee517b6f8a9f32cac25b301f

SHA256
3e86c6cba6ed087efb5029969a795634dd3aec4dbc8de37afa8ea222d59641cc

SHA512
abdd3cd058b5e98a676314d960672b8f1bfc2e3a5819ff1b8ea9a9feb5dafa9c2a93a18046dff21948f75d7a4f121ae7008b3036224e52ebe690cb87ce5ce076

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe

Filesize
184KB

MD5
3b360b5ad0789fe6c00ce15bcb7d9ee8

SHA1
194712d09ab48145388b0f7fc13d2af4b7feb9ea

SHA256
c1a7590bb3deeedee4c93b99377a6f7f74ee2991049c96a1fd059e9dc579ec37

SHA512
e5f896cc55473b6a880e8066df7db0117f40cc78668942d86aab1115bb31ed70639386879c3449a30e3d2c047b838dc87fa0ece58e84eb95edf10c74bec14c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe

Filesize
184KB

MD5
c51b4be73d9721b889c514d07c0edc97

SHA1
b15eefa5e1e68994d298fe68594a069078d1265b

SHA256
28dc2ac0016d980ddefeb6e3774a729ebc12a35159c6106278c6868bc107a127

SHA512
ccfb174e168d132380af000e5e3f3cc8727c28a6eec43ee21ac359711588d2b32efe3782fe0c7f2a2e1fcccd9f91b1b616375e8d33a31c03ae992a06f0191714

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe

Filesize
184KB

MD5
23a4c6b73208c178225982c657cf7cc5

SHA1
ab6c373bf75064195a8cf373d848fbc4fc3df274

SHA256
f034f9ec0decda22e5730420e8105b08841b8290d462a9fb44e16b2f483707b7

SHA512
76b83fcd63de068abe60ffae164c215bc163d920fc66a379d8402c1e638b1665c2bd7e2d138fea3753a65c0f4ed21775a9a1eb95f720d0103b1f33f7ee321719

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe

Filesize
184KB

MD5
308456ede5b882967521639e24718693

SHA1
e03be812b09a53214826eab31bf826a62c52f8d8

SHA256
49b2edc9dabc44acf3cd4ebdaeeeb5ff9fa99f326ff19336a299c41f277048e4

SHA512
2776ebbbc930d5ed779d32dd5bb5eb7fab65f7caabdac7287c302dc434ce3bc0ff3615256db24021be608e5802231174344fdd4241aa25834487ac3462f82dd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe

Filesize
184KB

MD5
98ece24696df0d078c15541824f5c00a

SHA1
5a5cbbbc9689341cc4704646a6e580e3ffa53e64

SHA256
732533d54cf39744c9bdd680b3d6e48dc5af22dd0d51f88dab5c47afa5852972

SHA512
9299931e2dcb8ebafe4a701dfd31e1cf9ee8b1fb91e30dbb9ee9ef20f159c1f87aafc6260760f17327589d7cfd7ac03addb139e86b6c895ae2cf718906436144

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe

Filesize
184KB

MD5
fc54ece815e2a6d0ef292ce183a91866

SHA1
70f08f7a29e3e7a4462eef5d614c754f73569153

SHA256
14e087ea62c19d5711ae8316ca5555c58bce09ff6842b346eff34dc983e7cfe1

SHA512
f9a5dd512c91457244eec36e0f36b77cb542ea9aa7c6fa552a262206f263e38e8b64a63247f12c15bf5fad0d92a67c05e370fad440225696ce7f2e1c91d3324f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe

Filesize
184KB

MD5
5e5e5c324b987d38cfc851158bf5b922

SHA1
836052b8e68fb359db43d09055a2ad19956c383b

SHA256
f639e631988590e5cd081f2d152a9240500b6d4a5760e0c68198c59ce01059a5

SHA512
4653ad5f2bf6932858348f681b958ed34429495c3c5a5a0a281382eb5409e5ff0c4237bfab49c70de0f2bb9b6bab316d502ee4f2013d438095466f3d12d7e63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe

Filesize
184KB

MD5
3d498c32d27b902d25d1e6a18eb0d834

SHA1
ac0b3691410df18564789e98ff6b106b7f2c8bfb

SHA256
332c983e70b7b3344186bed19b7698e658898227435bbfdf4295a6e411ab1432

SHA512
9badf3c4fa14208b45dc03a8e56c05aa9a117d746dcd5f391554e4db92e6ac496aac175460e574e654e44c4ae50ebef3e68f4cd8b903f46d2c3538142d74b1b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe

Filesize
184KB

MD5
763549f4f3b0d5d2893689e764666f7d

SHA1
bd5ef31f192d3d48b99f2a922a7b352245f1d3ce

SHA256
5ea9bd3061d4e13b855985f920eb235117483688de37eae83e03062ed660935c

SHA512
19ed4e6e9db348a5af410e1a76755a90aaad8f74bf68ecdd01daf2d140fb18b9c457a25029ed76c6fffb40660259d3a7abe3e8441c4646fab62bcd57c6effba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe

Filesize
184KB

MD5
111a1cc9e5f6271116b23191cea7f302

SHA1
92b85edd00c36a61702f7537bc031f59ef70a3fb

SHA256
91f32c6aba025be163b64ee945d2c7847356235e72015deb78922fbf16da8cae

SHA512
3ac0c938a27d1d91300fd5fbde4f77a7a5b67bce93798869a28e4bce39e344c31883e0e0b2de78d2948230ce410d082af7f033fe3b65ad65074e99ae747cf700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe

Filesize
184KB

MD5
4ac7eeeedf1c19ab82152780fd37e90c

SHA1
5734e13c65d693886b7efe83b66f8f5e81977c9e

SHA256
ecf142ec937195d381b1fe2fb141fc040730ee001cfe060b19cac9cb94725dc9

SHA512
1fc964936130974a42e86dcdf305a1c493f8d4d9645526d0db76a3943e465d5ed33c2937869f2a3e0afb1073507a0e3fbe2a95d77d95f6e874dc0c5fa6824ff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe

Filesize
184KB

MD5
7f59c5e0b9a0caa584486f473f068bf0

SHA1
5f1887952d24bcef5577831e92c819a90c73d939

SHA256
bd206e164dfaead280cec9a5ba44f0689fb6153d58c0c56b3b8aa71373f894ee

SHA512
38a5e97e444736c1e34208ce353e724b4e7d8a35c6228d7be19802e9abc41215c5fbd21a9130be07e5c999462c9850f88dd3a14f1bad28fd14871860e3cae754

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe

Filesize
184KB

MD5
18c1d363eb8311802863c5b0d27a578e

SHA1
30fae89d2555941902fb45256bca95a8aa711ebd

SHA256
ae2a984b56dbe51c19a4a60b3323f13b6c2b42899c19bc4390ebfcb517a44e5f

SHA512
1260eb0ace2641cdf05640f04f5f6e676f3d29d0d62482a0060a08ac6fd0822233b83241e75b6d747b2af85dca2e279223744b1ac92cdb5e4094f67375a4962d

Download Submit
memory/11468-4067-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/18936-4068-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads