374135d7701b7d826a024a9f8953c52971a55955128274a29f6837a965329bf3

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe
Size

184KB
MD5

9b250d03e1c604e85bec4d5076a1cdc0
SHA1

1daadf20d32dd7bf22458eb2594617a89c104ca4
SHA256

374135d7701b7d826a024a9f8953c52971a55955128274a29f6837a965329bf3
SHA512

6f0aa2d0289dc36cdf3a716fd6f79b5eb21257abd63c1e528dacde61a3a27ad99a7aa701f17211b83c41e3f3af472bda0b0c882f951765125eaa15efa89a0355
SSDEEP

3072:m5f6VooOyjYXZWXtKbCs8sVzKlvnqnxiuI:m5/o2JWXo84zKlPqnxiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2620	Unicorn-19694.exe
1712	Unicorn-37182.exe
4620	Unicorn-13232.exe
4180	Unicorn-9553.exe
460	Unicorn-9553.exe
3316	Unicorn-16330.exe
3740	Unicorn-30065.exe
1440	Unicorn-5251.exe
912	Unicorn-42754.exe
2608	Unicorn-52314.exe
4548	Unicorn-28364.exe
3948	Unicorn-7197.exe
3964	Unicorn-31793.exe
3620	Unicorn-33575.exe
1228	Unicorn-33840.exe
3236	Unicorn-10451.exe
2992	Unicorn-52039.exe
4348	Unicorn-47208.exe
3288	Unicorn-63636.exe
4952	Unicorn-55376.exe
2512	Unicorn-36902.exe
1396	Unicorn-20465.exe
3232	Unicorn-6730.exe
4576	Unicorn-57322.exe
4388	Unicorn-22512.exe
964	Unicorn-16290.exe
2288	Unicorn-47016.exe
3988	Unicorn-11940.exe
1348	Unicorn-3275.exe
1172	Unicorn-53793.exe
4692	Unicorn-17634.exe
3116	Unicorn-9465.exe
536	Unicorn-20326.exe
4260	Unicorn-29977.exe
3224	Unicorn-31832.exe
4800	Unicorn-13357.exe
4660	Unicorn-3143.exe
3168	Unicorn-26378.exe
2668	Unicorn-26113.exe
4824	Unicorn-26378.exe
1604	Unicorn-18764.exe
1612	Unicorn-8458.exe
3644	Unicorn-4374.exe
4192	Unicorn-56912.exe
4024	Unicorn-26740.exe
2112	Unicorn-48552.exe
3200	Unicorn-48552.exe
3552	Unicorn-3527.exe
4852	Unicorn-36035.exe
2588	Unicorn-36300.exe
1680	Unicorn-36300.exe
2892	Unicorn-34930.exe
1620	Unicorn-57488.exe
2968	Unicorn-57488.exe
2368	Unicorn-37622.exe
2836	Unicorn-32022.exe
2740	Unicorn-2812.exe
1720	Unicorn-53404.exe
1872	Unicorn-27316.exe
4316	Unicorn-34167.exe
2128	Unicorn-36968.exe
1168	Unicorn-47374.exe
3196	Unicorn-23424.exe
1428	Unicorn-14509.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
6216	5536	WerFault.exe	188
12792	7808	WerFault.exe	322
14576	14860	WerFault.exe	727
16200	16860	WerFault.exe	821
18408	13180	Process not Found	664

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8444	Process not Found
Token: SeChangeNotifyPrivilege	8444	Process not Found
Token: 33	8444	Process not Found
Token: SeIncBasePriorityPrivilege	8444	Process not Found
Token: SeCreateGlobalPrivilege	16748	Process not Found
Token: SeChangeNotifyPrivilege	16748	Process not Found
Token: 33	16748	Process not Found
Token: SeIncBasePriorityPrivilege	16748	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe
2620	Unicorn-19694.exe
1712	Unicorn-37182.exe
4620	Unicorn-13232.exe
4180	Unicorn-9553.exe
460	Unicorn-9553.exe
3316	Unicorn-16330.exe
3740	Unicorn-30065.exe
1440	Unicorn-5251.exe
912	Unicorn-42754.exe
4548	Unicorn-28364.exe
2608	Unicorn-52314.exe
3620	Unicorn-33575.exe
3948	Unicorn-7197.exe
3964	Unicorn-31793.exe
1228	Unicorn-33840.exe
3236	Unicorn-10451.exe
2992	Unicorn-52039.exe
4348	Unicorn-47208.exe
3288	Unicorn-63636.exe
4952	Unicorn-55376.exe
2512	Unicorn-36902.exe
1396	Unicorn-20465.exe
3232	Unicorn-6730.exe
4388	Unicorn-22512.exe
964	Unicorn-16290.exe
3988	Unicorn-11940.exe
4576	Unicorn-57322.exe
2288	Unicorn-47016.exe
1348	Unicorn-3275.exe
1172	Unicorn-53793.exe
4692	Unicorn-17634.exe
3116	Unicorn-9465.exe
536	Unicorn-20326.exe
4260	Unicorn-29977.exe
3224	Unicorn-31832.exe
4800	Unicorn-13357.exe
4660	Unicorn-3143.exe
4824	Unicorn-26378.exe
2668	Unicorn-26113.exe
3168	Unicorn-26378.exe
1604	Unicorn-18764.exe
1612	Unicorn-8458.exe
3644	Unicorn-4374.exe
4192	Unicorn-56912.exe
4024	Unicorn-26740.exe
2112	Unicorn-48552.exe
3200	Unicorn-48552.exe
3552	Unicorn-3527.exe
4852	Unicorn-36035.exe
2740	Unicorn-2812.exe
2892	Unicorn-34930.exe
2836	Unicorn-32022.exe
1680	Unicorn-36300.exe
2588	Unicorn-36300.exe
1620	Unicorn-57488.exe
2368	Unicorn-37622.exe
1720	Unicorn-53404.exe
2968	Unicorn-57488.exe
4316	Unicorn-34167.exe
2128	Unicorn-36968.exe
1872	Unicorn-27316.exe
3196	Unicorn-23424.exe
1428	Unicorn-14509.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	89
PID 4608 wrote to memory of 2620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	89
PID 4608 wrote to memory of 2620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	89
PID 2620 wrote to memory of 1712	2620	Unicorn-19694.exe	92
PID 2620 wrote to memory of 1712	2620	Unicorn-19694.exe	92
PID 2620 wrote to memory of 1712	2620	Unicorn-19694.exe	92
PID 4608 wrote to memory of 4620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	93
PID 4608 wrote to memory of 4620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	93
PID 4608 wrote to memory of 4620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	93
PID 4620 wrote to memory of 4180	4620	Unicorn-13232.exe	95
PID 4620 wrote to memory of 4180	4620	Unicorn-13232.exe	95
PID 4620 wrote to memory of 4180	4620	Unicorn-13232.exe	95
PID 1712 wrote to memory of 460	1712	Unicorn-37182.exe	96
PID 1712 wrote to memory of 460	1712	Unicorn-37182.exe	96
PID 1712 wrote to memory of 460	1712	Unicorn-37182.exe	96
PID 2620 wrote to memory of 3316	2620	Unicorn-19694.exe	97
PID 2620 wrote to memory of 3316	2620	Unicorn-19694.exe	97
PID 2620 wrote to memory of 3316	2620	Unicorn-19694.exe	97
PID 4608 wrote to memory of 3740	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	98
PID 4608 wrote to memory of 3740	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	98
PID 4608 wrote to memory of 3740	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	98
PID 4180 wrote to memory of 1440	4180	Unicorn-9553.exe	101
PID 4180 wrote to memory of 1440	4180	Unicorn-9553.exe	101
PID 4180 wrote to memory of 1440	4180	Unicorn-9553.exe	101
PID 4620 wrote to memory of 912	4620	Unicorn-13232.exe	102
PID 4620 wrote to memory of 912	4620	Unicorn-13232.exe	102
PID 4620 wrote to memory of 912	4620	Unicorn-13232.exe	102
PID 460 wrote to memory of 2608	460	Unicorn-9553.exe	103
PID 460 wrote to memory of 2608	460	Unicorn-9553.exe	103
PID 460 wrote to memory of 2608	460	Unicorn-9553.exe	103
PID 1712 wrote to memory of 4548	1712	Unicorn-37182.exe	104
PID 1712 wrote to memory of 4548	1712	Unicorn-37182.exe	104
PID 1712 wrote to memory of 4548	1712	Unicorn-37182.exe	104
PID 3316 wrote to memory of 3948	3316	Unicorn-16330.exe	105
PID 3316 wrote to memory of 3948	3316	Unicorn-16330.exe	105
PID 3316 wrote to memory of 3948	3316	Unicorn-16330.exe	105
PID 2620 wrote to memory of 3964	2620	Unicorn-19694.exe	106
PID 2620 wrote to memory of 3964	2620	Unicorn-19694.exe	106
PID 2620 wrote to memory of 3964	2620	Unicorn-19694.exe	106
PID 4608 wrote to memory of 3620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	107
PID 4608 wrote to memory of 3620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	107
PID 4608 wrote to memory of 3620	4608	9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe	107
PID 3740 wrote to memory of 1228	3740	Unicorn-30065.exe	108
PID 3740 wrote to memory of 1228	3740	Unicorn-30065.exe	108
PID 3740 wrote to memory of 1228	3740	Unicorn-30065.exe	108
PID 1440 wrote to memory of 3236	1440	Unicorn-5251.exe	109
PID 1440 wrote to memory of 3236	1440	Unicorn-5251.exe	109
PID 1440 wrote to memory of 3236	1440	Unicorn-5251.exe	109
PID 4180 wrote to memory of 2992	4180	Unicorn-9553.exe	110
PID 4180 wrote to memory of 2992	4180	Unicorn-9553.exe	110
PID 4180 wrote to memory of 2992	4180	Unicorn-9553.exe	110
PID 912 wrote to memory of 4348	912	Unicorn-42754.exe	111
PID 912 wrote to memory of 4348	912	Unicorn-42754.exe	111
PID 912 wrote to memory of 4348	912	Unicorn-42754.exe	111
PID 4620 wrote to memory of 3288	4620	Unicorn-13232.exe	112
PID 4620 wrote to memory of 3288	4620	Unicorn-13232.exe	112
PID 4620 wrote to memory of 3288	4620	Unicorn-13232.exe	112
PID 4548 wrote to memory of 4952	4548	Unicorn-28364.exe	113
PID 4548 wrote to memory of 4952	4548	Unicorn-28364.exe	113
PID 4548 wrote to memory of 4952	4548	Unicorn-28364.exe	113
PID 2608 wrote to memory of 2512	2608	Unicorn-52314.exe	114
PID 2608 wrote to memory of 2512	2608	Unicorn-52314.exe	114
PID 2608 wrote to memory of 2512	2608	Unicorn-52314.exe	114
PID 1712 wrote to memory of 1396	1712	Unicorn-37182.exe	115

C:\Users\Admin\AppData\Local\Temp\9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9b250d03e1c604e85bec4d5076a1cdc0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36902.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        8⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        9⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        10⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        10⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        10⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13951.exe
        9⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        9⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        9⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        9⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exe
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
        9⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        9⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        9⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        8⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        9⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        9⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        9⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30532.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
        7⤵
        
        PID:17848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7275.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        9⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        9⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
        9⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        9⤵
        
        PID:19408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        8⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        8⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
        8⤵
        
        PID:18080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        8⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        8⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        7⤵
        
        PID:17628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        8⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        8⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        7⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        7⤵
        
        PID:18064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        7⤵
        
        PID:18500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        6⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        6⤵
        
        PID:18804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        7⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 644
        8⤵
        Program crash
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        8⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        8⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        7⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        7⤵
        
        PID:18816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        8⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        8⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        8⤵
        
        PID:18836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15914.exe
        7⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        7⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
        7⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        7⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33184.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        6⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        8⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        8⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11990.exe
        8⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15922.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        7⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        7⤵
        
        PID:18168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58981.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27749.exe
        6⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47877.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
        7⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        7⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        6⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        6⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43175.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        5⤵
        
        PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17445.exe
        9⤵
        
        PID:18224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        9⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        8⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        8⤵
        
        PID:18840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
        8⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        7⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        7⤵
        
        PID:19340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5910.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        9⤵
        
        PID:17840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        9⤵
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        8⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        8⤵
        
        PID:17732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        7⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
        6⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 488
        7⤵
        Program crash
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        6⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
        7⤵
        
        PID:17444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        7⤵
        
        PID:19096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34320.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        6⤵
        
        PID:17684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        6⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
        7⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        7⤵
        
        PID:19260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        7⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27703.exe
        6⤵
        
        PID:18824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        5⤵
        
        PID:18100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        8⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        8⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        8⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24666.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        7⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        6⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        7⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        6⤵
        
        PID:17504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        6⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        6⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        6⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        6⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
        5⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
        5⤵
        
        PID:19372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        5⤵
        
        PID:19336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19938.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        7⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        7⤵
        
        PID:19292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        6⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
        6⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        5⤵
        
        PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
      4⤵
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43874.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe
        5⤵
        
        PID:19432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
      4⤵
      PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        5⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
      4⤵
      PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
      4⤵
      PID:16600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16330.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24523.exe
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        9⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        9⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        9⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        8⤵
        
        PID:18912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        7⤵
        
        PID:19268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        7⤵
        
        PID:18064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16254.exe
        6⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        7⤵
        
        PID:18900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
        7⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58981.exe
        6⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        6⤵
        
        PID:18560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        8⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
        7⤵
        
        PID:18772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4844.exe
        7⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        7⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        7⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
        7⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        6⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        6⤵
        
        PID:19124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        5⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        5⤵
        
        PID:19368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        7⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        7⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        7⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        7⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        6⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        6⤵
        
        PID:19368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1034.exe
        7⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        6⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
        5⤵
        
        PID:18448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        5⤵
        
        PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        6⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        5⤵
        
        PID:18132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        6⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        6⤵
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        5⤵
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
      4⤵
      PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
      4⤵
      PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
      4⤵
      PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        8⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39057.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        7⤵
        
        PID:16860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16860 -s 464
        8⤵
        Program crash
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        7⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47135.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
        7⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        7⤵
        
        PID:19388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        6⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        5⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27844.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        5⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        5⤵
        
        PID:19412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        6⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        5⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        5⤵
        
        PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        5⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
      4⤵
      PID:15880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
      4⤵
      PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56694.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        6⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        7⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        5⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        5⤵
        
        PID:10396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe
        5⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        6⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        5⤵
        
        PID:17784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        5⤵
        
        PID:19376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
      4⤵
      PID:10780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23460.exe
      4⤵
      PID:15812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        5⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        6⤵
        
        PID:17876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        5⤵
        
        PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
      4⤵
      PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
      4⤵
      PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62202.exe
      4⤵
      PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
    3⤵
    PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        5⤵
        
        PID:19256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
        5⤵
        
        PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
      4⤵
      PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
      4⤵
      PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
    3⤵
    PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
      4⤵
      PID:12996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
      4⤵
      PID:17568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61036.exe
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24477.exe
    3⤵
    PID:11964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
    3⤵
    PID:836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13232.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13232.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        7⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        9⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        10⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        10⤵
        
        PID:18796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exe
        10⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60542.exe
        9⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2404.exe
        9⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        9⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        8⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
        8⤵
        
        PID:19308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exe
        8⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        8⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53169.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        8⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        8⤵
        
        PID:19376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        8⤵
        
        PID:17656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        7⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        7⤵
        
        PID:18800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        7⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        7⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6708.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14509.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        9⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        9⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        8⤵
        
        PID:19424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        8⤵
        
        PID:19100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52705.exe
        7⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        7⤵
        
        PID:19284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        7⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        7⤵
        
        PID:19408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59687.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
        7⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        7⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        6⤵
        
        PID:17856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        6⤵
        
        PID:19340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        6⤵
        
        PID:19336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        6⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        5⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        5⤵
        
        PID:19324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        6⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        9⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        9⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        8⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        8⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32603.exe
        8⤵
        
        PID:19244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        7⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        7⤵
        
        PID:19388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        7⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        7⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
        5⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        7⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        7⤵
        
        PID:17792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        6⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        6⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        6⤵
        
        PID:19284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        6⤵
        
        PID:18052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        5⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44559.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        8⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        7⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
        7⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32067.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        7⤵
        
        PID:17468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        7⤵
        
        PID:19072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        6⤵
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        5⤵
        
        PID:17000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
      4⤵
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49486.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        5⤵
        
        PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        5⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        5⤵
        
        PID:19352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
      4⤵
      PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
      4⤵
      PID:11640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      4⤵
      PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
      4⤵
      PID:19072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        6⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        8⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        7⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33115.exe
        7⤵
        
        PID:18908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
        8⤵
        
        PID:17708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        7⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        7⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe
        6⤵
        
        PID:18896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
        5⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        7⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        7⤵
        
        PID:18572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        6⤵
        
        PID:19256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
        6⤵
        
        PID:18848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        5⤵
        
        PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        7⤵
        
        PID:18208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        6⤵
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        6⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        6⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        5⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        5⤵
        
        PID:18852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26134.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        6⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        6⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exe
        6⤵
        
        PID:18492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
        5⤵
        
        PID:19272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        5⤵
        
        PID:18056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
      4⤵
      PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
      4⤵
      PID:18220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        7⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        6⤵
        
        PID:17864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        6⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        6⤵
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        5⤵
        
        PID:12424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        5⤵
        
        PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30030.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        5⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        5⤵
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        5⤵
        
        PID:16976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
        5⤵
        
        PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46449.exe
        6⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        5⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60925.exe
        5⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        5⤵
        
        PID:16996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
      4⤵
      PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
      4⤵
      PID:19428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
      4⤵
      PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
    3⤵
    PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
      4⤵
      PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        5⤵
        
        PID:16788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
      4⤵
      PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27749.exe
      4⤵
      PID:18440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
    3⤵
    PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      4⤵
      PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
      4⤵
      PID:17636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
      4⤵
      PID:19044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-528.exe
    3⤵
    PID:9348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
    3⤵
    PID:12808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
    3⤵
    PID:17028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16290.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53404.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42037.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53189.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        8⤵
        
        PID:19308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        8⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        7⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22104.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        6⤵
        
        PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        6⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        7⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        7⤵
        
        PID:17776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        7⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        6⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        6⤵
        
        PID:18032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60132.exe
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        5⤵
        
        PID:18552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        7⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        7⤵
        
        PID:17768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        7⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        6⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5887.exe
        5⤵
        
        PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
      4⤵
      PID:15212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
      4⤵
      PID:19292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
      4⤵
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        6⤵
        
        PID:17576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22104.exe
        6⤵
        
        PID:19452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        5⤵
        
        PID:14576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        5⤵
        
        PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
      4⤵
      PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
      4⤵
      PID:16588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-430.exe
    3⤵
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        5⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6096.exe
        5⤵
        
        PID:19116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
      4⤵
      PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      4⤵
      PID:12916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
      4⤵
      PID:12164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
      4⤵
      PID:15932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
    3⤵
    PID:9024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
    3⤵
    PID:11424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe
    3⤵
    PID:15580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
    3⤵
    PID:5268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33575.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33575.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22512.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        7⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        6⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
        6⤵
        
        PID:19272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        6⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        6⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        6⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        5⤵
        
        PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        6⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        6⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        5⤵
        
        PID:14860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14860 -s 408
        6⤵
        Program crash
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27749.exe
        5⤵
        
        PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        5⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
        5⤵
        
        PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
      4⤵
      PID:14184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
      4⤵
      PID:17608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        6⤵
        
        PID:17740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        5⤵
        
        PID:17044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
      4⤵
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64713.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57829.exe
      4⤵
      PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe
      4⤵
      PID:16564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
      4⤵
      PID:8372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
      4⤵
      PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
      4⤵
      PID:18836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
      4⤵
      PID:17584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exe
    3⤵
    PID:8424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
    3⤵
    PID:12448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe
    3⤵
    PID:16572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
    3⤵
    PID:3652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        5⤵
        
        PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      4⤵
      PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        5⤵
        
        PID:19448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
      4⤵
      PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      4⤵
      PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
      4⤵
      PID:18268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
    3⤵
    PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        5⤵
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
      4⤵
      PID:15304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
      4⤵
      PID:18808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
      4⤵
      PID:16984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exe
    3⤵
    PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
      4⤵
      PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
      4⤵
      PID:12496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
      4⤵
      PID:16612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
    3⤵
    PID:9440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
    3⤵
    PID:12964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
    3⤵
    PID:17152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
    3⤵
    PID:3332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
    3⤵
    PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      4⤵
      PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
      4⤵
      PID:10388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
    3⤵
    PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15207.exe
      4⤵
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      4⤵
      PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
      4⤵
      PID:16204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
    3⤵
    PID:9356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
    3⤵
    PID:13888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe
    3⤵
    PID:17668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13483.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13483.exe
  2⤵
  PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
    3⤵
    PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      4⤵
      PID:17760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
      4⤵
      PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
    3⤵
    PID:10792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
    3⤵
    PID:14160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
    3⤵
    PID:3548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
  2⤵
  PID:7532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
    3⤵
    PID:18272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
  2⤵
  PID:10616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
  2⤵
  PID:14544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
  2⤵
  PID:18180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5536 -ip 5536
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7808 -ip 7808
1⤵
PID:12216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 14860 -ip 14860
1⤵
PID:14288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 17760 -ip 17760
1⤵
PID:3340

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:5980

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe

Filesize
184KB

MD5
a0ba8fd988229002938bafaa56c3579e

SHA1
0cc716d08ba26d12dea1eeef53cba9bf2e70fbd7

SHA256
1cd8d869d17feffc1e390836e3f531b4aa6d049d09c71e5588cb797f5e3bd4cd

SHA512
695467988462ac849b0e15e33395f5b467ecbbd22309e0bdf097ff86d7271b43a696413ffcc7d5ac819da3d0f7d8d4ea6de31de8bea4a77cedbed78d5b438fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe

Filesize
184KB

MD5
1b3069f9dc2b255a2a35a56e4d7134f0

SHA1
8513b3aa13a38b25f1a6a66665d2b0167fd7201c

SHA256
27dc08228f1c05a0924f71809963d9805129d670fae8f270aa40c84058536082

SHA512
b1745fba930b0d7545dcd611bcc46abea7914af2a66731bafea089a0984c59de582e1c8c7f393c63552f84238d6891ce703e7d4883b267e987a14c1b7bccf701

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13232.exe

Filesize
184KB

MD5
3a9479bf880c8eb5f50634e00e211845

SHA1
236c4b88a6b0d5e6a4619ad5c112ccdb0b31710b

SHA256
a1c8d5a07a942d1edf692567030caeb2f4835fb4e08eeb4c53ff677182d20f89

SHA512
3ce55b6fce64cd73a04faea483a5a5069151d2735841ba026f8b77d5088eac34e570cea6a992dd5b8ef6396babc6b822189cd1ae2189adbe89ff636e152e315b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe

Filesize
184KB

MD5
6166dd0486e576c344d212e558e052e1

SHA1
fe73613d2bcdcc04b211c40e052afc9febae6b95

SHA256
297d180c65eed2b23c527d76aa66ffb7d4596501c9da9a53edd1929d69899dfd

SHA512
13581beff307deb1e73a34f39a798383da691b1f28be7112dca4d896fc0f8bcfeafc071bfbe79cca284ab39f8078ade838122b065edaef92cf348ffb5f02c187

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16290.exe

Filesize
184KB

MD5
541b06b104cffb494739246c81a773e5

SHA1
11f4597246d421e8dd2220dd29f2491bf9f64e04

SHA256
2af07498a916b68c0598c953a455494633e06edc6a0c33b6d7131c1a264145de

SHA512
61becb153ef9a2ad511f520710fa6a8040cab9b949ed1aa1ec25f670e4d1273c0c3e815b676f9e6b764645e3d67fc4feb332ff0534af3a179786d556533b348c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16330.exe

Filesize
184KB

MD5
d769e106db8de36891948f548ae66373

SHA1
0b104824071701555ead595b20321fb3e6aec54b

SHA256
b35e56882ba6f0cf27b01f83b9078a3096eef0ac1dc69d896b4eb7dcae3e17f1

SHA512
c2e0f826492a7209705fd017c30e9eecbe2a8bc26e32bf55618784828a7478495e3a29bd41411fe26327d65d18729f75a88692be0893785f526d44ade414cedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe

Filesize
184KB

MD5
238db356782047504d1ee806809428e5

SHA1
7922c1bd59163b5e00727ef9b842b9af94d180f2

SHA256
c0eeab00177a991858f49f7fb07dfab7201362f978ef9b0210cc11f5d1eeae7c

SHA512
75abc985a2ed4d2e5e82209ede0acb6b8e647df72b336075b9401aca3a3c03307314434d4fa8730c44f7391120c217b90d19442e3c47a61666e3a9f33f21a89f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe

Filesize
184KB

MD5
74eb5e5cc8b446e3a33a152f33e75fbf

SHA1
194093289939a70fb8043bcba2c811c7a35bbc90

SHA256
478f32543f5e612ce089ef997e2c68aa2b163d2670cadea9b74fe9fa10486aa6

SHA512
624b1181beb9b4c49af1b83de732e9a2878f96cfe4764464f71c1f0aabbc383c0e91a656d8693ab69cd427395c27238df6726301b767a4028617dbeaaee3937c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe

Filesize
184KB

MD5
a55d4f863f930f9a3af29e578cd77a3f

SHA1
baa070719ee7b3d929bc58ddd39b2e7414549efc

SHA256
637aa743e1aceda4269b01b0e9911372cb7c8be33c662e163838bdf3f0c49907

SHA512
2fc7a6c13c736c1436d83bb5a2e5e1087aba157143d298b03939729e3120a4a85e06ddb5e4d0c6f2acc749af81cf05d64400bd2b329d2603459b964dc48ac6f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22512.exe

Filesize
184KB

MD5
a2ebf1724e3fbba850ccb561db9a7633

SHA1
a5fa74b50a083841f44593a12e6127aec507f000

SHA256
4064ca009fb36cc10bb49ce545abb97bd98bbbb1d2a2590f3e6fc70b4ceba5a5

SHA512
f2c93d14e5840418f72f3a0162e829060852781e409468d7a801754b9e9c72f169bad396876dbf9c8fc0fae7181b341da87c01733f98a27c094fffdb8aa38e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe

Filesize
184KB

MD5
27287f7be05ab977e0a9bcb21760651c

SHA1
5fbb33f08437d933c321a5555d893c7453344e6b

SHA256
5145e0cc8a83853fb05fbcfc80d021599dd91c2551cf749c63ef7f623e6b2437

SHA512
373232f498573dbf9bcbaf2cb67b20fa4903fa6da5bd632ca8934001fa34e296fe207905aad2be7ba8c394e7c5375181af1f72c927c1611ae2ab03e0eed09eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe

Filesize
184KB

MD5
2dafacb75e852aa525c55c1b695eb8f7

SHA1
45f4568b929f0316ccb20ce420d15729753c67dc

SHA256
41847b9e05474eeb14f809ae2a6b4f5a3377db19dab2c8f5bd0da7988e465636

SHA512
e8417dd343eab60a7375eebb1e1272fb8a3b7d34d573857af09ebcce8df10818ae15cc137f3fe1fd3b1a3b0dbe5a343abe659356c9d47a298f830c2f52bb2f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe

Filesize
184KB

MD5
3f875f18426f44c90bcea9ad5d43c39a

SHA1
61968d8469e896183b4badad9b6f8d2d9d91fc77

SHA256
a5cc586836646d0138a9dc08f264423b49f1713e322e39034911966b726d544e

SHA512
d20162ae9939e3c3cf527234d52bfc73c2630f382db08cdf9e22d2b31ea209289db3153f4131da284cc3b6390e5666c8592614dcbfe81ee524f7b360520db31a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe

Filesize
184KB

MD5
83bfeeed902bf075997525e80d5badec

SHA1
83e4cab8ddccbf10d76bae9ddce1bd47ba6fd375

SHA256
979bf01bdf54ee400ef2e176b3a1d726284bc977d7341940938bb10484a282ba

SHA512
218b92065776a5489d725fed769172b01ec4f92e59d1ad13ef2f9f9f5c73363c76eb80eaff7daa9f0f0446ab197fc51c41ee1a45f6ee20cc49575883eeec0a6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33575.exe

Filesize
184KB

MD5
855b3dd6b7d6261f6de36e465e4a57aa

SHA1
d2035e02d9745d498ca20e79af9a7522b4ad5e53

SHA256
5f52b81465645cc33bb864b1de09b1852df1f60c61f7722d4f2c49d85679fbdc

SHA512
b5d29401c4c77d2bbf1ecc9a4845b60c5368e101d95ac8317cb7400a1be338863857d7257a9037b545b246d68afbab4192682894b299d98149becf8df7ff2ce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe

Filesize
184KB

MD5
a6738f85da0bc974d568726a11b7ed2b

SHA1
901ab8c2f9b255849efcf24bf3a008e145e7c9ee

SHA256
0866c01fd1fbb736e7f330f0d6f53e918f5d5dfaa92d6605ec37790765161133

SHA512
6f66f622ff78cb73c98de58ffcf020cb41806f4b1565af8954170af5f05936f7a2a4b1518acb4146e17d56505aef41774035253628b1aeb52f528dcb007107b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe

Filesize
184KB

MD5
c2a03fa4488fb4b3e3100f0c7d9f86a2

SHA1
2686f7b46f8e3030748cb245d4e4edf9b1b861f4

SHA256
290b9a7c0a3793555272b2910440e3a379982df9bd62707a8b6f2be2eec9d7a4

SHA512
9229d36c9181ac3e56d969ca092fb2228f08042682ceec4257f6f788f1651d8d345ac7195cb7266a34dd62d5be67788174363c1b66cb8ce6c095553bbb92dad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36902.exe

Filesize
184KB

MD5
ada84983a799e61a355a9f9f0cf23b8b

SHA1
87a9f5f85e5661a66b962c9be9269fcb197eeee4

SHA256
befd49d8e97b7c3185490658ba01d0e584df13b314d607decc813c813fc24c97

SHA512
944bf5f805aa9f3e19e03808481377dded0e2fd270a47b0fe67ae4c508a3e25b798eb71cfc55367c6fcac10afc8b1b59ca8805650a0a8a216e1a155a65bce841

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe

Filesize
184KB

MD5
4439a5492342ba94679c157f419cfba3

SHA1
8ca39d398ac8bb21b2364c5f0f14ded4a4a2e556

SHA256
1f62c467327f4ec866a1c64dd06651d56704794d188faaa3f963749b655e8ff3

SHA512
9dc294c0c29ec958e95673ba3dc0b302041accca4cb1b22402e03ab705396cffaa929f89c20b57c7ffdcb8bd1658b45c12c9d940aced4c27c24234ffb250d471

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe

Filesize
184KB

MD5
747de69b1e0deb9338b95e7278ab7913

SHA1
1e29c24bb6ae7a821d3dd8fd58423d613ad2c16c

SHA256
1a70ac7a7ff02a935a0508945611eae273ceb4f5b80da5dc2aa0471e81dd9350

SHA512
f607365fdc96f66b275ddfc353a4a9cecda5b33a51f9479e0cb1d7547a6c39483d29ffe9f8d4fec04cc95125f2a3fd92906b30dbd7bf67656c296006180809bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe

Filesize
184KB

MD5
feba0c4185847518a0016a1320484bb6

SHA1
46a469f8a09ed823533a9cacb416f51b67060f84

SHA256
bdc288f0af0f6d0b9b521317c5c538cefcf17d1eadd411360eaac215f212ecb1

SHA512
80d0101c441a17ce4c35c2bf40fc83e4f73a888b06928d0399c035f4bebd3113b13a2f01d3a3b8d836d39f15d205acf24c41d095309798c4ff5c5862a056d63f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe

Filesize
184KB

MD5
4939db7e99fe4ea9569c0605d0bcb704

SHA1
6743c141f56165b11ecafd2e0267597783da00b3

SHA256
105ad9a1144a1b07f0ee2281b38ad42f356e299209cf3ae7d779110a9433de97

SHA512
303c8ef9c1a6ca2aadad6aad2998ddcb61051dfba9eaefbe5351ac314c4688eeb7f8be0dd21cf5bf6dc89e339415e25e8c60439d1aa7ce42633a5865a2c538e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe

Filesize
184KB

MD5
747989f029a9b08ca72ab49a0554671e

SHA1
8864f31db6bdf9b7b9f3ce4dc9abfe8fa1175f8a

SHA256
7a71113d3fbfb4dde6207b64b5d4d12397a49ef62e21e9cde8c2ef0a2b17b5bf

SHA512
9f4e230c44ce69fb6180db7fe2e4eb7d075001ef7979a5255b2bb2196f82c11db8269cb43e96d51a5baccaf362cd8de0b01284d1de690cd005fbc9868fc2b500

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe

Filesize
184KB

MD5
3ae7e932f042e495a12a683ebc01a8c1

SHA1
8831b10ed09035ce8f564c380c0d151409b99565

SHA256
443ab2b74d7efc19f53775497bd1f3fe4a21876331b4231abe5077e8220121d0

SHA512
4ef239deae3db4ab6c51873752e4464e4149cbe8cdde72d90eaaab903fd8ab8eefbcf3937ddca167ac66f616ac3e01ef79814791e9c64da3bb48b7a8a71e8142

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe

Filesize
184KB

MD5
d2b42962992703dc53e6ac528848f3e6

SHA1
e031f4624fad0fef34a1106a33c0d4f16d86229a

SHA256
2c3a2596046f212cdf890ef3f7a3005f325340ea12b1efd851f8560cec1dcb72

SHA512
f95a1b4be985b8498371c183f2aa01e92ec0c330f6d9298e8d5fb2fcd1f9d1aa5bdd61a475092f2c32b549e6d4144d70b7c71c55ce7d3a947d25fd91775e0880

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe

Filesize
184KB

MD5
c750fe50bba38c6103455c2a03f9bbec

SHA1
7da3cc3e584becf00d5b1543d2674cf9c5646ce0

SHA256
2201a87fafd408ef1b8b29a27cf0e6140b9dcc25b742f9e50e46be2eb71b2741

SHA512
8dca588f450f79b5e215e6de05332b472073d7e21a436c59850740ce83c9603a02cde62aaa56721f54822266563aef71adcadda7342eff8049163b41f7d82db0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe

Filesize
184KB

MD5
2cd8d3af34a6715932894cfb4be6bf61

SHA1
1509019349fe54c51ed3bda5d6c06ae3fc13ec82

SHA256
d56db39d7269a315273818cd7876cb15be6f0c2dcfa51cce70624717adf3fbf5

SHA512
12fe805f9c3123ab799b6eef36049dcde8433692992bae4036256cfb921a680a8366b51d14008b895eb3708cc3d204940f36d6b77d139d4db88edfcda1b3afa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe

Filesize
184KB

MD5
93167b4bf436801af0f574d20fc4d813

SHA1
1bf35a4a88ae05dc3e51bcffe07dbbdb8ecaf748

SHA256
31344f7361a9bf4aec8fcf301cb890a091fcd19e74d905ce1498c0ceed1831e6

SHA512
409d32e5deab1336bb149c60eafa9b2946a610cfbbb9ab48f4a9a1dd22a41291d06f82a7b8e19cf31cab815adb33b643e2cb1e6dcf6aaceacb1f429ad053e7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe

Filesize
184KB

MD5
bdd341936731a3f57a6921c332f46a37

SHA1
a9ebab4fcd78e598042622f3ab1cb61b2435d6cf

SHA256
6ebc06c3153ca88220d3a7138b3d9f14bdbed8368104a5f420dfb8e07ce37a68

SHA512
2bb4b67582d7ea2b5eb4428899fdb2be6fb138cb760082075c368d4835df403c2af185866170654d960f90d1cb322a707994a47fb390ac91dded54b88f110e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe

Filesize
184KB

MD5
24b3c7cb152e418fdb1f55e9e313edbb

SHA1
c7fcb31f0d7bcf46d25ae140895f1128d3028ac5

SHA256
453ec500dc052d964728085719369e7e4ccfa14ec80970e79df8ab7b4b37e317

SHA512
0ac67076551c031b4595a2f0f20d4e81318b1d97d184bae9fb2e2e19cb334c5a55125a58c4b1a88d883f8fe0f949120264e5e7b4633aff6069a10dd6bf62e873

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe

Filesize
184KB

MD5
e347b5af7b17148d1c6ba593fc0835b1

SHA1
dc68c55481fbd5a45526a3981515391ea6fce2e2

SHA256
4d433836150ba40d3b6952808c4bf708735b5113138b23c18a0476cae555339c

SHA512
1a846e5f7ad88e28a365669d7efb02796d0590077171a6ab7b19665f3e38b07cb6aa322236bcd4629a0c18d72ee9768e1c65e9ad3c3ef3978c501ae53577a1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe

Filesize
184KB

MD5
a2736245a70f695b10cab4305203849e

SHA1
290cadca064e06cf7a3e0481765a6b40677e1693

SHA256
2dc8908f1f88d9eaac461599ed2f460fa6039a73b30d532d837c068053088366

SHA512
289e6e9e9516f6fc85f2a01a174075ae4ef5b4e643e8b7d3c7a5fe12cf26916590a4b6ee79536e67ae01006dc01c5dc8bed25e072025b5ebe82820c22bf8d0b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe

Filesize
184KB

MD5
a28168193b0b9f7378d86fc89729b724

SHA1
81d2269ff8297148b3ebc3698c09faeaacf12a6f

SHA256
918c9677b9e69fb9e2490ee457a3317bdac06b95ab6cc59665ea86f74e845f70

SHA512
57d1cf1043d69732e4aa21888f20290a6d19b284b98da8d93103dfd270ad20e338b268a4e6c83d2e9c523868e8424c2149946352bf98be1ec5ead42153ca8e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7197.exe

Filesize
184KB

MD5
ed5cf739b94ceee6e056eb02ac02a24b

SHA1
a478f6409c8da31be65af11269cc74f9f37e2fad

SHA256
178a8d3af9b5140e36d1a00317e2c0de178a725d1ef5d2d1b19b5c351c226d4b

SHA512
b118de813320a662dfe5e2bd738fd88f7bd0a6088efb0d397aec687933d26b63f7af0838e21d8007a6ee545b219609dec2cce4c81e8dec48ae31ea0d44e27df2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7275.exe

Filesize
184KB

MD5
3a4a939a03053173327e143ed9b3ee85

SHA1
162a132751fe2ec5b152cac99b478f60410330e7

SHA256
80c91a11315820abef47b7d99518e60eaab2944128bf4682f4ee7b4dc8f4d804

SHA512
3bf8ab1da60ef3c1602fb83f3204992cb666d900cc0a24a12287bd088ae79251eb962b6c9b7c52cb97135d5121b378fdaf6dab36a915e12a354b588c4c1b13dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe

Filesize
184KB

MD5
bd6c6f06a4f4fc9789244230cfa66205

SHA1
477ea229dfd0e6bb1b9ea002d3abe46b7d835b8b

SHA256
4981d0ac498339e12f987900b08c4650df989d084eec2811fd5819738ea3f5f2

SHA512
c3ab7a50eea6bf2cbf4b6be1b1a6554c81d985e739f843161c9cb72c3d5891aa079e761ad2af92954b96eafa1c83a2ad91f64a916df33e2a57c15f59046978b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe

Filesize
184KB

MD5
e05aa7f51ccdb631944da383b5957f73

SHA1
3bc1fc4b40040b7a037d17eca57f8a1b905c25a6

SHA256
16ec5d8ee17517fc08d7439940b5ee44bbccdb4dfdcac254ae2306b0aab7d5f5

SHA512
60d21cfb9a73848727fabaee2b6184e45b90f0c849c762353dd82721473b5fc06c0145a6b374c40796660dbf270bbc7215fb2f1b611c4486471408b02be86484

Download Submit
memory/5588-3059-0x00007FFB0AF50000-0x00007FFB0AFA9000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads