5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe
Size

184KB
MD5

ae761d5bc122bd53ccff1e8a02978e93
SHA1

87c6221c86b8557b5d4cb5cb457826ce216bd54f
SHA256

5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36
SHA512

d53095d119ff4126a0257966f2c71c73ddac45866d3e9cbe0432e64ab024df1adb12d66556227f932801f9745102d408bd9fe2b598555ea19cd91049f96b45e9
SSDEEP

3072:10JpLdoO9go0ZRhtKAqZ8slz0lvnqnxiuc:10hoG0RhA8Mz0lPqnxiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4624	Unicorn-24578.exe
496	Unicorn-31952.exe
3288	Unicorn-65179.exe
4940	Unicorn-10052.exe
1836	Unicorn-26066.exe
4128	Unicorn-39802.exe
1788	Unicorn-56876.exe
4628	Unicorn-50099.exe
4652	Unicorn-1967.exe
2152	Unicorn-11012.exe
2368	Unicorn-10747.exe
4964	Unicorn-56684.exe
2444	Unicorn-44846.exe
5112	Unicorn-18579.exe
3880	Unicorn-29853.exe
1300	Unicorn-30146.exe
4468	Unicorn-2112.exe
4988	Unicorn-32284.exe
2904	Unicorn-4058.exe
4164	Unicorn-7587.exe
5076	Unicorn-29077.exe
2552	Unicorn-29077.exe
1516	Unicorn-64956.exe
3800	Unicorn-51370.exe
2664	Unicorn-6004.exe
4712	Unicorn-16939.exe
2680	Unicorn-19739.exe
3928	Unicorn-26794.exe
4276	Unicorn-1028.exe
4860	Unicorn-18168.exe
1012	Unicorn-3721.exe
1648	Unicorn-43898.exe
1864	Unicorn-21017.exe
4152	Unicorn-37676.exe
3244	Unicorn-58188.exe
4524	Unicorn-8895.exe
3344	Unicorn-15672.exe
2100	Unicorn-58096.exe
5060	Unicorn-13647.exe
3368	Unicorn-42336.exe
3900	Unicorn-49113.exe
3084	Unicorn-26000.exe
4384	Unicorn-52450.exe
3932	Unicorn-52450.exe
4828	Unicorn-5387.exe
2916	Unicorn-55143.exe
5084	Unicorn-42890.exe
1528	Unicorn-58780.exe
3144	Unicorn-64380.exe
4308	Unicorn-36114.exe
4708	Unicorn-36114.exe
1672	Unicorn-49742.exe
4976	Unicorn-40098.exe
3108	Unicorn-45963.exe
3656	Unicorn-41075.exe
4156	Unicorn-61749.exe
3264	Unicorn-11993.exe
724	Unicorn-30468.exe
832	Unicorn-45827.exe
3764	Unicorn-13369.exe
2668	Unicorn-54650.exe
704	Unicorn-13254.exe
2308	Unicorn-32283.exe
4452	Unicorn-58179.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4224	4276	WerFault.exe	124
13632	13940	WerFault.exe	666
17020	3964	WerFault.exe	757
17012	13992	WerFault.exe	754
17004	1944	WerFault.exe	756
17376	1332	WerFault.exe	755
17728	13992	WerFault.exe	754
15056	372	Process not Found	1178

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7256	dwm.exe
Token: SeChangeNotifyPrivilege	7256	dwm.exe
Token: 33	7256	dwm.exe
Token: SeIncBasePriorityPrivilege	7256	dwm.exe
Token: SeCreateGlobalPrivilege	15680	Process not Found
Token: SeChangeNotifyPrivilege	15680	Process not Found
Token: 33	15680	Process not Found
Token: SeIncBasePriorityPrivilege	15680	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe
4624	Unicorn-24578.exe
496	Unicorn-31952.exe
3288	Unicorn-65179.exe
4128	Unicorn-39802.exe
4940	Unicorn-10052.exe
1836	Unicorn-26066.exe
1788	Unicorn-56876.exe
4628	Unicorn-50099.exe
4652	Unicorn-1967.exe
4964	Unicorn-56684.exe
2368	Unicorn-10747.exe
2444	Unicorn-44846.exe
2152	Unicorn-11012.exe
3880	Unicorn-29853.exe
5112	Unicorn-18579.exe
1300	Unicorn-30146.exe
4468	Unicorn-2112.exe
4988	Unicorn-32284.exe
2904	Unicorn-4058.exe
4164	Unicorn-7587.exe
1516	Unicorn-64956.exe
5076	Unicorn-29077.exe
2552	Unicorn-29077.exe
4712	Unicorn-16939.exe
3800	Unicorn-51370.exe
2664	Unicorn-6004.exe
2680	Unicorn-19739.exe
3928	Unicorn-26794.exe
1012	Unicorn-3721.exe
4860	Unicorn-18168.exe
1648	Unicorn-43898.exe
1864	Unicorn-21017.exe
4152	Unicorn-37676.exe
3244	Unicorn-58188.exe
4524	Unicorn-8895.exe
3344	Unicorn-15672.exe
2100	Unicorn-58096.exe
5060	Unicorn-13647.exe
3368	Unicorn-42336.exe
3084	Unicorn-26000.exe
3900	Unicorn-49113.exe
1528	Unicorn-58780.exe
4384	Unicorn-52450.exe
3932	Unicorn-52450.exe
4828	Unicorn-5387.exe
5084	Unicorn-42890.exe
2916	Unicorn-55143.exe
3108	Unicorn-45963.exe
4708	Unicorn-36114.exe
1672	Unicorn-49742.exe
3144	Unicorn-64380.exe
4976	Unicorn-40098.exe
3656	Unicorn-41075.exe
3264	Unicorn-11993.exe
724	Unicorn-30468.exe
4156	Unicorn-61749.exe
832	Unicorn-45827.exe
3764	Unicorn-13369.exe
2668	Unicorn-54650.exe
704	Unicorn-13254.exe
2308	Unicorn-32283.exe
4452	Unicorn-58179.exe
4324	Unicorn-26475.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4624	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	93
PID 2004 wrote to memory of 4624	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	93
PID 2004 wrote to memory of 4624	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	93
PID 4624 wrote to memory of 496	4624	Unicorn-24578.exe	95
PID 4624 wrote to memory of 496	4624	Unicorn-24578.exe	95
PID 4624 wrote to memory of 496	4624	Unicorn-24578.exe	95
PID 2004 wrote to memory of 3288	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	96
PID 2004 wrote to memory of 3288	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	96
PID 2004 wrote to memory of 3288	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	96
PID 3288 wrote to memory of 4940	3288	Unicorn-65179.exe	99
PID 3288 wrote to memory of 4940	3288	Unicorn-65179.exe	99
PID 3288 wrote to memory of 4940	3288	Unicorn-65179.exe	99
PID 2004 wrote to memory of 4128	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	101
PID 2004 wrote to memory of 4128	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	101
PID 2004 wrote to memory of 4128	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	101
PID 4624 wrote to memory of 1836	4624	Unicorn-24578.exe	100
PID 4624 wrote to memory of 1836	4624	Unicorn-24578.exe	100
PID 4624 wrote to memory of 1836	4624	Unicorn-24578.exe	100
PID 496 wrote to memory of 1788	496	Unicorn-31952.exe	102
PID 496 wrote to memory of 1788	496	Unicorn-31952.exe	102
PID 496 wrote to memory of 1788	496	Unicorn-31952.exe	102
PID 4940 wrote to memory of 4628	4940	Unicorn-10052.exe	103
PID 4940 wrote to memory of 4628	4940	Unicorn-10052.exe	103
PID 4940 wrote to memory of 4628	4940	Unicorn-10052.exe	103
PID 4128 wrote to memory of 4652	4128	Unicorn-39802.exe	104
PID 4128 wrote to memory of 4652	4128	Unicorn-39802.exe	104
PID 4128 wrote to memory of 4652	4128	Unicorn-39802.exe	104
PID 2004 wrote to memory of 2368	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	105
PID 2004 wrote to memory of 2368	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	105
PID 2004 wrote to memory of 2368	2004	5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe	105
PID 1836 wrote to memory of 2152	1836	Unicorn-26066.exe	106
PID 1836 wrote to memory of 2152	1836	Unicorn-26066.exe	106
PID 1836 wrote to memory of 2152	1836	Unicorn-26066.exe	106
PID 3288 wrote to memory of 4964	3288	Unicorn-65179.exe	107
PID 3288 wrote to memory of 4964	3288	Unicorn-65179.exe	107
PID 3288 wrote to memory of 4964	3288	Unicorn-65179.exe	107
PID 4624 wrote to memory of 2444	4624	Unicorn-24578.exe	108
PID 4624 wrote to memory of 2444	4624	Unicorn-24578.exe	108
PID 4624 wrote to memory of 2444	4624	Unicorn-24578.exe	108
PID 1788 wrote to memory of 5112	1788	Unicorn-56876.exe	109
PID 1788 wrote to memory of 5112	1788	Unicorn-56876.exe	109
PID 1788 wrote to memory of 5112	1788	Unicorn-56876.exe	109
PID 496 wrote to memory of 3880	496	Unicorn-31952.exe	110
PID 496 wrote to memory of 3880	496	Unicorn-31952.exe	110
PID 496 wrote to memory of 3880	496	Unicorn-31952.exe	110
PID 4652 wrote to memory of 1300	4652	Unicorn-1967.exe	111
PID 4652 wrote to memory of 1300	4652	Unicorn-1967.exe	111
PID 4652 wrote to memory of 1300	4652	Unicorn-1967.exe	111
PID 4128 wrote to memory of 4468	4128	Unicorn-39802.exe	112
PID 4128 wrote to memory of 4468	4128	Unicorn-39802.exe	112
PID 4128 wrote to memory of 4468	4128	Unicorn-39802.exe	112
PID 4628 wrote to memory of 4988	4628	Unicorn-50099.exe	113
PID 4628 wrote to memory of 4988	4628	Unicorn-50099.exe	113
PID 4628 wrote to memory of 4988	4628	Unicorn-50099.exe	113
PID 4940 wrote to memory of 2904	4940	Unicorn-10052.exe	114
PID 4940 wrote to memory of 2904	4940	Unicorn-10052.exe	114
PID 4940 wrote to memory of 2904	4940	Unicorn-10052.exe	114
PID 2444 wrote to memory of 4164	2444	Unicorn-44846.exe	115
PID 2444 wrote to memory of 4164	2444	Unicorn-44846.exe	115
PID 2444 wrote to memory of 4164	2444	Unicorn-44846.exe	115
PID 2368 wrote to memory of 5076	2368	Unicorn-10747.exe	117
PID 2368 wrote to memory of 5076	2368	Unicorn-10747.exe	117
PID 2368 wrote to memory of 5076	2368	Unicorn-10747.exe	117
PID 4964 wrote to memory of 2552	4964	Unicorn-56684.exe	116

C:\Users\Admin\AppData\Local\Temp\5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe
"C:\Users\Admin\AppData\Local\Temp\5191aab4fa86a4a3758dc7cd17e87f653de4270e2300f1a2d05e2d2096465a36.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe
        6⤵
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 212
        7⤵
        Program crash
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54650.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
        8⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        8⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
        7⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        7⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        7⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3721.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        8⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        8⤵
        
        PID:18296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        8⤵
        
        PID:17032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7110.exe
        7⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        7⤵
        
        PID:17524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        7⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        7⤵
        
        PID:18244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1630.exe
        7⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56508.exe
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        6⤵
        
        PID:17568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        6⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        7⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        7⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34023.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
        6⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        6⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        6⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        6⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 436
        7⤵
        Program crash
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18683.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        5⤵
        
        PID:17548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        9⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1114.exe
        9⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        9⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        9⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        8⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        8⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        7⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        7⤵
        
        PID:16772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        7⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        7⤵
        
        PID:18252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        7⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        6⤵
        
        PID:17460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28395.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33644.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        6⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 444
        7⤵
        Program crash
        
        PID:17004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        6⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        6⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        5⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47774.exe
        5⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15055.exe
        5⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
        5⤵
        
        PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        7⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        7⤵
        
        PID:18260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        7⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        6⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        6⤵
        
        PID:17556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        6⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        6⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13992 -s 468
        7⤵
        Program crash
        
        PID:17012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13992 -s 468
        7⤵
        Program crash
        
        PID:17728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        6⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
        5⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exe
        5⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64868.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        6⤵
        
        PID:17440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        6⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        5⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34023.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        5⤵
        
        PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        5⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        5⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        5⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        5⤵
        
        PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
      4⤵
      PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
      4⤵
      PID:13404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
      4⤵
      PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
      4⤵
      PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
      4⤵
      PID:10792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        8⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        8⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        7⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        7⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        7⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46092.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        6⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45538.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        7⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10182.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        6⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        5⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30078.exe
        5⤵
        
        PID:18008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        7⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        7⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        6⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20240.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        7⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1058.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        6⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        6⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53109.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1775.exe
        5⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        5⤵
        
        PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40098.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
        5⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        6⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        5⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        5⤵
        
        PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        5⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        5⤵
        
        PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        5⤵
        
        PID:18288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38034.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
      4⤵
      PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
      4⤵
      PID:17592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
      4⤵
      PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        8⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exe
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        6⤵
        
        PID:14160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
        6⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        6⤵
        
        PID:18196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        6⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        6⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2953.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45656.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39626.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe
        6⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        5⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        5⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        5⤵
        
        PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        6⤵
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        5⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        5⤵
        
        PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        5⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        5⤵
        
        PID:10292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
      4⤵
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      4⤵
      PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
      4⤵
      PID:16192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
      4⤵
      PID:18232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        6⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        6⤵
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        5⤵
        
        PID:13200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49290.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        6⤵
        
        PID:17616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        6⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        5⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        5⤵
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        5⤵
        
        PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51442.exe
      4⤵
      PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41137.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
      4⤵
      PID:14360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
      4⤵
      PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
      4⤵
      PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
      4⤵
      PID:11456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
    3⤵
    PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      4⤵
      PID:15036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
    3⤵
    PID:7540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
    3⤵
    PID:10976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
    3⤵
    PID:14016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
    3⤵
    PID:18320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19177.exe
    3⤵
    PID:9592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        8⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        9⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        9⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        9⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        9⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 436
        10⤵
        Program crash
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        9⤵
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33705.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46258.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        8⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        8⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        8⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        7⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        7⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
        8⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57061.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        8⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10182.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
        7⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        6⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        6⤵
        
        PID:17476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        6⤵
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        8⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48622.exe
        8⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        7⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        7⤵
        
        PID:18404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        7⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        6⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31438.exe
        6⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        6⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        7⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        6⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        5⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        6⤵
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52898.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        5⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        5⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
        5⤵
        
        PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57803.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
        7⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        7⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27889.exe
        7⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        6⤵
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        7⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        7⤵
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        6⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        6⤵
        
        PID:18284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
        5⤵
        
        PID:16432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
        5⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43779.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        7⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9974.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48622.exe
        6⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        6⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-628.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11106.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        6⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        6⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        5⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
        5⤵
        
        PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55912.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        5⤵
        
        PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
      4⤵
      PID:8300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
      4⤵
      PID:332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      4⤵
      PID:16320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65418.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        8⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        8⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        8⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        8⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56324.exe
        7⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
        7⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16098.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        7⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        7⤵
        
        PID:18000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        7⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        7⤵
        
        PID:17588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46092.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        6⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        6⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        5⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        5⤵
        
        PID:12244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        5⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        5⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        5⤵
        
        PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43379.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        5⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        5⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        5⤵
        
        PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        6⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        5⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15055.exe
      4⤵
      PID:17488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
      4⤵
      PID:9992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
      4⤵
      Executes dropped EXE
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        6⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        6⤵
        
        PID:16592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        6⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
        5⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        5⤵
        
        PID:18180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48997.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        5⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        5⤵
        
        PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        5⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        5⤵
        
        PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
      4⤵
      PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
      4⤵
      PID:11772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
      4⤵
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        5⤵
        
        PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31776.exe
      4⤵
      PID:12228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
      4⤵
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
    3⤵
    PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
      4⤵
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
      4⤵
      PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
      4⤵
      PID:15248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
      4⤵
      PID:17580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
    3⤵
    PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
    3⤵
    PID:12404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
    3⤵
    PID:17356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
    3⤵
    PID:11216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        8⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
        8⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        7⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5330.exe
        7⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24136.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        7⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44142.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        7⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        7⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        6⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        6⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        6⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
        5⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        5⤵
        
        PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        7⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        7⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        6⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
        6⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        5⤵
        
        PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61552.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        6⤵
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        6⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        5⤵
        
        PID:13792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        5⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        5⤵
        
        PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        5⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        5⤵
        
        PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
      4⤵
      PID:364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
      4⤵
      PID:9972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2112.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exe
        7⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        7⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        7⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        6⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        6⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        5⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-640.exe
        5⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        5⤵
        
        PID:9588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        5⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        6⤵
        
        PID:18420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        6⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        5⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57061.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        5⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        5⤵
        
        PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
      4⤵
      PID:13940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13940 -s 212
        5⤵
        Program crash
        
        PID:13632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
      4⤵
      PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
      4⤵
      PID:11224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
      4⤵
      PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        6⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42070.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        5⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe
        5⤵
        
        PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
      4⤵
      PID:13144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
      4⤵
      PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
      4⤵
      PID:1172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
      4⤵
      PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
      4⤵
      PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40220.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
      4⤵
      PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
      4⤵
      PID:8648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
    3⤵
    PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46912.exe
      4⤵
      PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
      4⤵
      PID:18400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
    3⤵
    PID:7364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
    3⤵
    PID:11440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
    3⤵
    PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
    3⤵
    PID:10156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        5⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        7⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        7⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        5⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exe
        5⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        6⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        6⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        5⤵
        
        PID:17496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17730.exe
        5⤵
        
        PID:16584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      4⤵
      PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      4⤵
      PID:13340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60192.exe
      4⤵
      PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      4⤵
      PID:8264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10514.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        5⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exe
        5⤵
        
        PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
      4⤵
      PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46092.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
      4⤵
      PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
      4⤵
      PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
      4⤵
      PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe
      4⤵
      PID:10548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        5⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        5⤵
        
        PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
      4⤵
      PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
      4⤵
      PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
      4⤵
      PID:9652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe
    3⤵
    PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
    3⤵
    PID:10140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
    3⤵
    PID:12428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
    3⤵
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33529.exe
    3⤵
    PID:17428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
    3⤵
    PID:8412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        5⤵
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        5⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        5⤵
        
        PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
      4⤵
      PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
      4⤵
      PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
      4⤵
      PID:15008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
      4⤵
      PID:17608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
    3⤵
    PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
      4⤵
      PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
      4⤵
      PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
      4⤵
      PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
      4⤵
      PID:11604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-871.exe
    3⤵
    PID:7632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
    3⤵
    PID:9044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
    3⤵
    PID:10880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
    3⤵
    PID:13900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
    3⤵
    PID:14064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
    3⤵
    PID:18412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
    3⤵
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42362.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        5⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
      4⤵
      PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
      4⤵
      PID:15320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
      4⤵
      PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
      4⤵
      PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
    3⤵
    PID:7432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
    3⤵
    PID:10472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
    3⤵
    PID:13208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
    3⤵
    PID:13216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
    3⤵
    PID:17136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
    3⤵
    PID:11608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
  2⤵
  PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
    3⤵
    PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
      4⤵
      PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
      4⤵
      PID:11256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
    3⤵
    PID:10116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
    3⤵
    PID:12796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
    3⤵
    PID:16528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
  2⤵
  PID:7464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
  2⤵
  PID:10176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
  2⤵
  PID:3236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
  2⤵
  PID:3784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
  2⤵
  PID:16664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
  2⤵
  PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4276 -ip 4276
1⤵
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 13940 -ip 13940
1⤵
PID:14696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3964 -ip 3964
1⤵
PID:16764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1944 -ip 1944
1⤵
PID:16952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 13992 -ip 13992
1⤵
PID:16960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1332 -ip 1332
1⤵
PID:17164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 13992 -ip 13992
1⤵
PID:17812

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe

Filesize
184KB

MD5
3203648b39a0ba1b0d9659f256ad3ac8

SHA1
753a14de37d0c2b0e73de42ce7634bd43a67b4ed

SHA256
c03abeef82999e38ac3d75ae1c09b90611e44edfe817080213c6c986a7485ea9

SHA512
787526ddbd72aeccd999050012dfd01df486f9496c7279b33110070b8d2c6e042daf312d23901e30ea54f2896e1a80cceb23f56dcbc4ad7b07367c9218def28e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe

Filesize
184KB

MD5
279ae3326bc55ece0c85572308eb040e

SHA1
7a66efbccbb0299ec5f269f3e29d126b17ec171b

SHA256
e2d95a076a0468b9903d0ef4830fe053e4ebd5576e472ec6b5355e5f226c4626

SHA512
4fb8ed4fe5662f4decf7a14d62f3a0d21044a178c29ed9d7de8d30d10cc1d1ba2404f32a635458c5f05f8629be1986c2e241a55f56dc9c97d27332d9a26b129d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1058.exe

Filesize
184KB

MD5
8449c60616e1899efbd256aeb312f501

SHA1
584362f5d8ea3b386afa088154bc58af87cde8b4

SHA256
5efa43e15c03be51d090ba111225b667bc8178f058f7abf0056e9b61e59fd81a

SHA512
52f8d62df96f80a7ac05fa9f36c04cae3cc7672e27ab995cd70a53c4a6c43cb0b163b3b74c17093b4eb2e352d014c690300c6be1039e543d53acfa8e7f92fd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe

Filesize
184KB

MD5
85e1f5874ae258997083f9da9a923e79

SHA1
f5269b80755e77821b56ad37538a9ef1cc06463d

SHA256
0371a4e25e1e680431da7c1629238288863b6950e723dd69fa12bc11aa7c7db7

SHA512
a1179ab573252a5cfe6ee51b60ba44fa1a0355a04c2e48884e9ae8e729b8c1bceebaea4584694f97316b3265f8db0271df62ec29f2211bb33d91af0828bab024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe

Filesize
184KB

MD5
bef30cff1520469cbea38ba5ab2e3d80

SHA1
e68b3416829d5a9623c531f9219f71f65f71b63a

SHA256
015e452e99b7a5d3856d2cf78aa2767627e8f00ebe692220254c38ff81aa2a29

SHA512
44b7e188461a3614898d064d7f7e897c5f395ad192e28584bd1cd970c7faba81fd463e3bbbaeabe561cd994e1bb5472121c95eda101b33cbda6abeac7936f9dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe

Filesize
184KB

MD5
128e3da4a05dc25843a32a641870f2a5

SHA1
af4b4c18eaa7dd9f8ebbb0de9658b167b2f0f94a

SHA256
0fe5c527d78c51dd4f76c4443465241f8cadbd63444b9b11b6096e0f6e817ede

SHA512
99e9e9a1b9dc4aefd08b4382b8967369e70c8a6d62da61f7005e249725257055bba8b99ae310ae5bb6e21d80775e9c71b45b6399e776a0b832da5fbb452c67b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe

Filesize
184KB

MD5
2ea8e8eccb11c6c92afbaa04f3ac1f0c

SHA1
f69782fd97116ac41862069b78c4fd9e054f9420

SHA256
0d33e7cd2afe7b26c2eb45b7b348c10517f560a6ab4be7e31bc8a97cb61ee6e9

SHA512
2fcc707da4af35ecd2a63d01f0308bdd8eb60b3f1e45def708555f586b2f4b2be5ed4a5698615759cacd6694007c72a598e3f10aba7b71b0456d67217544415f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe

Filesize
184KB

MD5
1a0aa5665bac2941c33d1c47303ce467

SHA1
d759c1b1cf0c53bdf71ddfa2fb1c552fb390d0bb

SHA256
1bc39bbbda1d01ab91f6cfd1f54ac34508e5a12b7e0018030a2a89187dbef8c3

SHA512
d593bfabb4ab93327efc60e393e46f51a490e3fa0b1b4489c782425db7984a1dde711617d86697f67d2d83e1908d2d69c922cbd21c2301864ea9a8d3a1322d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe

Filesize
184KB

MD5
64835d811c216fd91b7bb0d83fb45c86

SHA1
ec015ff182e0dd6bec208298b4bbe92898b0e416

SHA256
8d4f9a8e4dd595a9d7d89c484dd78c1d932a0f130862e4e0ac0e8bb664c1de5f

SHA512
03847cdbce26fa343d249da5d3c5962fa4bc61103732b76a5da0b59dc8d4aa1ba40046468fa4b7a13eb5d5f10d289a63456b95aaf8fb91c7010c6a2545b9ba89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe

Filesize
184KB

MD5
4d8c7d66ee781db8d260fd293e73c211

SHA1
1ead14b37011d0ae12661005442e3b101ee50a0c

SHA256
75ab1707a7309553bad8f78d80c99341d0698776c7769de17fee21fbc298bbfd

SHA512
684e6321b0982274afd99d12101bc66c37476fe95c0a50c338265882b8b56efa80494a82de6e21839d0853d303c753d72975c7c7a5e9c34db7e74454d362b9a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2112.exe

Filesize
184KB

MD5
491c1d7ec8831d685db518ed0c4235b5

SHA1
b1af91236144604ed524c3eec8822883b66d14e1

SHA256
8d303f7f990e1842bceee1cfedd5124a3bbe63f7e73f9bf736498ee5583ab469

SHA512
07191350a7397f686ac063e9be4eebc839c433f67cb6dd4f0786acfa07aa9e2826194adc4976058b55f45a33b3fd2a1e89a5073e482b782912e96cc2905c6c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe

Filesize
184KB

MD5
55e76863c7af415271f709a460913ff0

SHA1
464fe688a421a34036184d113727503bb11f0d5b

SHA256
bdb9b34b0c7d7389416309f60b11832c5126ff23fe58d9ca7eea2a1edbd7a420

SHA512
6f5f503f2e66bf6e51dee2e6fabb31f6d8fcb7f1ae505b9938d00545e4cfc08fe90729d8f347ace50f13dda50f8530cb037393a06b02ee2b64681f71ed7572c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe

Filesize
184KB

MD5
47667527380168c8b611208190c3f213

SHA1
4c9b715d11ee5cfd1806dc0d02e5af68e9555ea3

SHA256
2d195f7b516bb817c1983fdcd8cf7787726a625ba947d4a4c36c2a397e85b737

SHA512
24da1f196e3e26209a4c73472092b3a66aa4b6ccc26a862941b0c1e91b8ee61cf525c0b41ec11108290218566d86e97787bbab04de1672a7a7288e35d13ab3a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe

Filesize
184KB

MD5
d5e330ba7c0299187b07573fa06df197

SHA1
f9e775797e17248c6e89a6c6d203e9d954a18b1d

SHA256
ac62701c9e1502ebc9b7fa21b5317c454944a9a21b9bb6744f8445b163e4873f

SHA512
23c6b1c8d547b475c166bbe3fe6692573678d078058ea7f0964bc133f2d580d19ab25103afd2460737e03e12f9cbb4802901f7541ec44755b57edcdbac2cc1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe

Filesize
184KB

MD5
34596cf929c43fc0a4988fd604bfc7bd

SHA1
b08e63e781d03a1d149a914f487b2048c8657cfc

SHA256
fa766ddec68a744e21c1a2faac1929920f91e7eedbb6aff25e9f50711d394401

SHA512
bdbfd51081a7e5632a6d545a0304209c588c3b3ecad6ec68c0af73634d85dcc72b0c9a295dbe0690260de44a89f41976b693fda3172d2f070af3c6aef7f25e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe

Filesize
184KB

MD5
fec35389a9cae9b7135e4ebae643493f

SHA1
1ff06ab590ea4dedfa477d6a7b73f83e1e77b1d3

SHA256
1c690c8e4cbf0cd9d140340a5bd050efd6e4765c343603554ddc1104a735c114

SHA512
873f5c38ad5d7f7b5b3fe56f0511934155586f1f7c2f68a1b023afd404d92db74a1214abe99af2f73002bb6e22c5068f99da79ed12114f6ac8df445fc022f0b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe

Filesize
184KB

MD5
e0aa6c50b583f4948da0912b0b36d308

SHA1
c927eaf2043113b35d55f3e855b451817669da63

SHA256
919e92ec8f7b451aaeffc833b41ca5442314d4a5ad0603f0f5f24df5833b953f

SHA512
bb4b40e20a5687fb8482d626a33398e70c6c23357469e6c884ee223f33968c9abfd191b9b9b5dbf2dd5493c5c2d94d73e883ac49514c067198f36542f78e654b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe

Filesize
184KB

MD5
bde5552a1af2bee66b615df770823ccf

SHA1
bee162d97590a44df3d74c41530188433e24a60d

SHA256
2ddddd1c16c407575395b37d3ce1ef863245a6f12eb540d799203bc4970cc864

SHA512
695c8da72cf8f47f544b15cabcab76dc876561428f7b92b00969c1a232e4c4d2f98576315284c1a2ff89e92570290b1833ad5140db6567871ec95ff09707fcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe

Filesize
184KB

MD5
08b83fedde909404caf29b06fef92312

SHA1
6e9818305e060c94a4f711853e8cc41c9d081073

SHA256
19f85429a1b6db9842d884819b2118a3b9307c580cae8ff6b3db4fff077d43b2

SHA512
4fcd80a59df117da8cbc290a5005d17afc45130a24abf6957b2357c85bbcfbf2419936c66c60570365f531d8c049b40daf63337ea484a82f500aa5e7bb547102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe

Filesize
184KB

MD5
8eb3c212d242c913942a76c285ae96af

SHA1
38a045f0bba9b88232956500f77fc13adea35138

SHA256
436be68b0872dbbac4a086504fdae61ec2be8daa6edc2bfa97f48246779545ef

SHA512
02eee8b6e8f412557eeeadd2403617d2e3ced8474759e08262f918305b3b7a4ed4f84e596acf822e4934b8cf762e3c0207090df039462e8a2dbd517eba9e66d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3721.exe

Filesize
184KB

MD5
355511e70d36b835d9b06f94e6c8f097

SHA1
b2bde94aef5b5cf08ed7afc88946d75d628d8f3c

SHA256
976c1c15ca61e09bd6bf32adf74c0c69bc981a4fcaa183c44cb5559ef3097c30

SHA512
d29e07c7658cf299615da8cfac0523b2d1f83f68fbedc3251ee53775d815c2bd7258fa3f8b370c9c4234bbe0152d3d547f1231c110b11d17b104db1b26e32eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe

Filesize
184KB

MD5
ef2a203db939f4db62fe3b0c33d0935c

SHA1
75e3bc2367ab39804e182af573afd8bcb07cb703

SHA256
e555d6f5334605810f02d69e0056f219d362de3faef6fce56faccf6a31a96037

SHA512
b277e77716ab4b7a784367c57ccd5cf20a3e5dbb4fea9d5f536e4970950b2afb27f2dd6b7a568eee58479e222edbf0c637acae4fccf01f9f27e362e5004bc5d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe

Filesize
184KB

MD5
0932e125c6d9749d511d4a0c272a0cf6

SHA1
3b1b77c311540b4b0545691716bb5cb1da5cc2e6

SHA256
610e0e94a022a01179e897ec5c87149c21cdb48f062e5d3c90ca3966e5c36137

SHA512
c121690d079fb756f935e976e675b4a9fa7b98d523281ff3125226ef49d60a0b0d97fb121efd61cb4a73b5a8e7ac9f0fe17dd4cd3b791d05d4345bb93baef03a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe

Filesize
184KB

MD5
20fdfff1aed6bcc3981ea5cc0aeeab0a

SHA1
476914d98abe5489738bd5e28c994a8aec56fb20

SHA256
76acab385f286fc5d60add4c983ef0789bd3c0aebdab8652819cb80dd5b1e67b

SHA512
8a8383da05ed4ce8ef03563427020cfdd258f47bb2ddb02ad0a4acffc0f3d124213d3c359d5924fb869622ef6900bc4ddd84ac6841ca57150bb96f10c960f231

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe

Filesize
184KB

MD5
48de1a6d1e7b32c0d24cda3c6d03a655

SHA1
e91c9684f2b178557a53f0f84bffdace16b849ab

SHA256
21e83a7595cb737e6f961019be0428a0493516d3c019411a205b7cb38c8b9e53

SHA512
ca6f4a0dfc619b9e606321a19d04f1df16340f5a97513cfa8c585daf5dfad7267986ee14281494596cb80c2c3d498d8bdc2ebcca0bf1de3429f036357959821c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe

Filesize
184KB

MD5
6955ccbd96ee20514aced3e0d29ae6e7

SHA1
bb477bb1e3bbc78380f09e33de805fa8fc1e6825

SHA256
1ec042c85081bd7ffff152791dd613048fdc5e2dcacd74bb35d0581ffc5a3aa8

SHA512
aa0aa8b36c7916180346dcb3b35b489d14c3166cde891b0dbc72057f39dcb50837de9a1a9edace0deaa204cc16213f2deb469f0580b981f59bf8b1a3ba28f511

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe

Filesize
184KB

MD5
5fd0302677382b4a953ed1f46e44d966

SHA1
c8fcbd3a2bf4be50b42a3dd886fc8fb1ce7ff58c

SHA256
9b03f2d1e60064f436aad5eb88c6cb24876a76dff37693864030e10802ded287

SHA512
6c192991a00154c9a0cfc33436e3156f662390d11f3437b46f4d2a03abe46139fbc895189bd32ea7e9f46cceceb877b7ec1168ccdc74fba5dbcf15223ef50ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe

Filesize
184KB

MD5
51475bfd4d30e915f87e278a1d36319c

SHA1
01808935bba872d332529543c24e32cbb05a835b

SHA256
37dab9e9858f100e753c3f587bea85d7be26863b4a3ceb77497cebea34f9832b

SHA512
fb915a893c5dd86720c020168786b9885ab7e348a6e25c907a932e4c286a14990366dc4d55ed77d8dc18f406f03fc7b4f7ee6f88869206fa325b3dc5607599b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe

Filesize
184KB

MD5
846d87047a4a806c3bb047ccf47e8785

SHA1
0b98e4e9a52439bce9faee9b79c158009d26e668

SHA256
3bd7188f5e2355c38d13e2e56da748a38a3fa05d8d260f6795a7a4a70812ef22

SHA512
41d401ae8eb2ddb7e15cec6a0ca29b06b33cdbf27cbf0d72e81b1a02c32a2f4453a112042f5698439f1d98b47411ac64924011dafdbfcdcc6b964312ad1d4df9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe

Filesize
184KB

MD5
263d6e4461e7ed44231fa9c67510acbf

SHA1
7b7c63f131ed0f14598a152d13c4257b3e5c61dd

SHA256
7ec3a248026b0bf820bdcac0f2c32feff770cfb1d3bcc806febb6b7e367ea059

SHA512
7341a8eb01f304d7ac4d718cb9d29da6ac3a7a384e53b246300eec5f261570e0e014b3e4a43df127f0fb10d7d28e6b9eb872d7a3c5ea61e2d33a1f20fb3c72d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe

Filesize
184KB

MD5
bcfa1084ddcf5a58457bc2a9d21a955c

SHA1
ac72004d81df4136ff48eb7ae6acb627626fef9c

SHA256
8cafa0d448a71d461196e4f9f34a190e8db43fa03a2cdb10096e987bc3172ebc

SHA512
b9ad403903d429b479289898ad603331c9844ac89ef7a1fb7ed72a87b4ee025ad7e0dbad9eefa12f0b4efe5a4418c66e926922e6dfa5d2fa95dddd331025f1ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe

Filesize
184KB

MD5
27df6c120df9624a1f484073ddd473fc

SHA1
cc9781982ab813d68f7709410381667fb47dfa9f

SHA256
9013c5b6636d71f87173f8f279a42cbef11f68d53a92cdaf65d03468a316a0a5

SHA512
4c583c1daf4b0d7d7f90655452122c8d4e83647a1efb46db2f225c3206fc451c913ba67d7a6d50355668fd96c778c5eaa73ca40fe0d105bf273061db1a593866

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe

Filesize
184KB

MD5
94997723a5e456fee136ebf4923234d8

SHA1
de6d126b0034a6066bc5c8340933adbc9b0e7b04

SHA256
a0a31e470b3c78415ebcb10d3a94e853a318e581e07307048938cdb4d1c5138b

SHA512
36efe32b955fe6b7a1c19af1b144bbee9c1e387958fc366a611cff58724e545db943b0cd580d48d842f80562d3d65b27fe2cdd7d4a2470f852631d33001beb15

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads