3ea2eae9e1bee71f01ac4e2feb2c4f172305d6339fc4cc54c5fee2d3e85c6b1d

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe
Size 184KB
Sample240529-m8v1vsdc29
SHA256 3ea2eae9e1bee71f01ac4e2feb2c4f172305d6339fc4cc54c5fee2d3e85c6b1d
MD5 5296def678917545cb496aaa4e5cd860
SHA1 a1a052ed4064bc8dc0620cd33ef386e168bf79fa
SHA512 825854093ee8134705ded2e5f586d39d0e20c045c4b62bbec4c65e6d4f4f05c10c134f4ba13158929af8f8e04bcd3539acbe68010005b6a58a4bf0d0c635dfd7
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9Hz3AvnqnxiuR:YN7odvRUVUNz3APqnxiu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2412	Unicorn-41976.exe
3588	Unicorn-11415.exe
1176	Unicorn-44835.exe
4728	Unicorn-34140.exe
412	Unicorn-63283.exe
3808	Unicorn-60682.exe
3056	Unicorn-5359.exe
64	Unicorn-41644.exe
856	Unicorn-5442.exe
2556	Unicorn-12863.exe
1496	Unicorn-53704.exe
4264	Unicorn-47574.exe
528	Unicorn-37368.exe
3484	Unicorn-37103.exe
4076	Unicorn-58343.exe
4852	Unicorn-27228.exe
4860	Unicorn-52287.exe
4028	Unicorn-32656.exe
1756	Unicorn-18165.exe
1252	Unicorn-3875.exe
2892	Unicorn-37102.exe
1724	Unicorn-40632.exe
4644	Unicorn-32464.exe
2176	Unicorn-32199.exe
3664	Unicorn-4238.exe
1116	Unicorn-7767.exe
2424	Unicorn-65136.exe
3076	Unicorn-36910.exe
436	Unicorn-43762.exe
4596	Unicorn-52692.exe
1516	Unicorn-38394.exe
5088	Unicorn-44161.exe
4548	Unicorn-51815.exe
3080	Unicorn-63512.exe
4984	Unicorn-32685.exe
4288	Unicorn-39776.exe
3464	Unicorn-15079.exe
4136	Unicorn-64015.exe
2872	Unicorn-48499.exe
1300	Unicorn-14695.exe
3188	Unicorn-63896.exe
4060	Unicorn-51644.exe
4676	Unicorn-19334.exe
1960	Unicorn-11166.exe
2156	Unicorn-20817.exe
1584	Unicorn-18780.exe
2908	Unicorn-43839.exe
4988	Unicorn-15848.exe
5072	Unicorn-11763.exe
5080	Unicorn-11763.exe
3252	Unicorn-15848.exe
4012	Unicorn-56880.exe
388	Unicorn-56615.exe
2256	Unicorn-24570.exe
1136	Unicorn-40352.exe
764	Unicorn-31421.exe
3380	Unicorn-31414.exe
4324	Unicorn-17885.exe
4400	Unicorn-61327.exe
3952	Unicorn-24570.exe
1764	Unicorn-24016.exe
3700	Unicorn-4171.exe
4704	Unicorn-37590.exe
3448	Unicorn-24592.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
6488	3108	WerFault.exe	157
6744	4536	WerFault.exe	163
8012	7144	WerFault.exe	282
11212	792	WerFault.exe	283
15460	2212	WerFault.exe	284
7492	5020	WerFault.exe	1008
7232	3856	WerFault.exe	914
10104	9188	Process not Found	1274

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8620	Process not Found
Token: SeChangeNotifyPrivilege	8620	Process not Found
Token: 33	8620	Process not Found
Token: SeIncBasePriorityPrivilege	8620	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe
2412	Unicorn-41976.exe
3588	Unicorn-11415.exe
1176	Unicorn-44835.exe
4728	Unicorn-34140.exe
412	Unicorn-63283.exe
3808	Unicorn-60682.exe
3056	Unicorn-5359.exe
64	Unicorn-41644.exe
856	Unicorn-5442.exe
2556	Unicorn-12863.exe
4264	Unicorn-47574.exe
1496	Unicorn-53704.exe
4076	Unicorn-58343.exe
528	Unicorn-37368.exe
3484	Unicorn-37103.exe
4852	Unicorn-27228.exe
4860	Unicorn-52287.exe
4028	Unicorn-32656.exe
1756	Unicorn-18165.exe
1252	Unicorn-3875.exe
2892	Unicorn-37102.exe
4644	Unicorn-32464.exe
1724	Unicorn-40632.exe
4596	Unicorn-52692.exe
2176	Unicorn-32199.exe
436	Unicorn-43762.exe
3664	Unicorn-4238.exe
1116	Unicorn-7767.exe
1516	Unicorn-38394.exe
3076	Unicorn-36910.exe
2424	Unicorn-65136.exe
5088	Unicorn-44161.exe
4548	Unicorn-51815.exe
3080	Unicorn-63512.exe
4984	Unicorn-32685.exe
4288	Unicorn-39776.exe
3464	Unicorn-15079.exe
4136	Unicorn-64015.exe
2872	Unicorn-48499.exe
1300	Unicorn-14695.exe
3188	Unicorn-63896.exe
4060	Unicorn-51644.exe
1960	Unicorn-11166.exe
4676	Unicorn-19334.exe
2156	Unicorn-20817.exe
1584	Unicorn-18780.exe
2908	Unicorn-43839.exe
4988	Unicorn-15848.exe
3252	Unicorn-15848.exe
5072	Unicorn-11763.exe
5080	Unicorn-11763.exe
1136	Unicorn-40352.exe
2256	Unicorn-24570.exe
388	Unicorn-56615.exe
4012	Unicorn-56880.exe
764	Unicorn-31421.exe
3380	Unicorn-31414.exe
3952	Unicorn-24570.exe
4324	Unicorn-17885.exe
4400	Unicorn-61327.exe
1764	Unicorn-24016.exe
3700	Unicorn-4171.exe
4704	Unicorn-37590.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 2412	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	88
PID 4084 wrote to memory of 2412	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	88
PID 4084 wrote to memory of 2412	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	88
PID 2412 wrote to memory of 3588	2412	Unicorn-41976.exe	91
PID 2412 wrote to memory of 3588	2412	Unicorn-41976.exe	91
PID 2412 wrote to memory of 3588	2412	Unicorn-41976.exe	91
PID 4084 wrote to memory of 1176	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	92
PID 4084 wrote to memory of 1176	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	92
PID 4084 wrote to memory of 1176	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	92
PID 3588 wrote to memory of 4728	3588	Unicorn-11415.exe	94
PID 3588 wrote to memory of 4728	3588	Unicorn-11415.exe	94
PID 3588 wrote to memory of 4728	3588	Unicorn-11415.exe	94
PID 2412 wrote to memory of 412	2412	Unicorn-41976.exe	95
PID 2412 wrote to memory of 412	2412	Unicorn-41976.exe	95
PID 2412 wrote to memory of 412	2412	Unicorn-41976.exe	95
PID 4084 wrote to memory of 3808	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	97
PID 4084 wrote to memory of 3808	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	97
PID 4084 wrote to memory of 3808	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	97
PID 1176 wrote to memory of 3056	1176	Unicorn-44835.exe	96
PID 1176 wrote to memory of 3056	1176	Unicorn-44835.exe	96
PID 1176 wrote to memory of 3056	1176	Unicorn-44835.exe	96
PID 4728 wrote to memory of 64	4728	Unicorn-34140.exe	100
PID 4728 wrote to memory of 64	4728	Unicorn-34140.exe	100
PID 4728 wrote to memory of 64	4728	Unicorn-34140.exe	100
PID 3588 wrote to memory of 856	3588	Unicorn-11415.exe	101
PID 3588 wrote to memory of 856	3588	Unicorn-11415.exe	101
PID 3588 wrote to memory of 856	3588	Unicorn-11415.exe	101
PID 412 wrote to memory of 2556	412	Unicorn-63283.exe	102
PID 412 wrote to memory of 2556	412	Unicorn-63283.exe	102
PID 412 wrote to memory of 2556	412	Unicorn-63283.exe	102
PID 2412 wrote to memory of 4264	2412	Unicorn-41976.exe	103
PID 2412 wrote to memory of 4264	2412	Unicorn-41976.exe	103
PID 2412 wrote to memory of 4264	2412	Unicorn-41976.exe	103
PID 3808 wrote to memory of 1496	3808	Unicorn-60682.exe	104
PID 3808 wrote to memory of 1496	3808	Unicorn-60682.exe	104
PID 3808 wrote to memory of 1496	3808	Unicorn-60682.exe	104
PID 3056 wrote to memory of 528	3056	Unicorn-5359.exe	106
PID 3056 wrote to memory of 528	3056	Unicorn-5359.exe	106
PID 3056 wrote to memory of 528	3056	Unicorn-5359.exe	106
PID 4084 wrote to memory of 3484	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	105
PID 4084 wrote to memory of 3484	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	105
PID 4084 wrote to memory of 3484	4084	5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe	105
PID 1176 wrote to memory of 4076	1176	Unicorn-44835.exe	107
PID 1176 wrote to memory of 4076	1176	Unicorn-44835.exe	107
PID 1176 wrote to memory of 4076	1176	Unicorn-44835.exe	107
PID 64 wrote to memory of 4852	64	Unicorn-41644.exe	108
PID 64 wrote to memory of 4852	64	Unicorn-41644.exe	108
PID 64 wrote to memory of 4852	64	Unicorn-41644.exe	108
PID 4728 wrote to memory of 4860	4728	Unicorn-34140.exe	109
PID 4728 wrote to memory of 4860	4728	Unicorn-34140.exe	109
PID 4728 wrote to memory of 4860	4728	Unicorn-34140.exe	109
PID 856 wrote to memory of 4028	856	Unicorn-5442.exe	110
PID 856 wrote to memory of 4028	856	Unicorn-5442.exe	110
PID 856 wrote to memory of 4028	856	Unicorn-5442.exe	110
PID 3588 wrote to memory of 1756	3588	Unicorn-11415.exe	111
PID 3588 wrote to memory of 1756	3588	Unicorn-11415.exe	111
PID 3588 wrote to memory of 1756	3588	Unicorn-11415.exe	111
PID 2556 wrote to memory of 1252	2556	Unicorn-12863.exe	112
PID 2556 wrote to memory of 1252	2556	Unicorn-12863.exe	112
PID 2556 wrote to memory of 1252	2556	Unicorn-12863.exe	112
PID 412 wrote to memory of 2892	412	Unicorn-63283.exe	113
PID 412 wrote to memory of 2892	412	Unicorn-63283.exe	113
PID 412 wrote to memory of 2892	412	Unicorn-63283.exe	113
PID 4264 wrote to memory of 1724	4264	Unicorn-47574.exe	114

C:\Users\Admin\AppData\Local\Temp\5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5296def678917545cb496aaa4e5cd860_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44161.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        9⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        10⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        11⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        11⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        11⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        10⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        10⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        10⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36018.exe
        9⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        9⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        9⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        9⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        9⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        9⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        9⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        9⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30799.exe
        8⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        9⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        9⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        9⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        9⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe
        9⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        9⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        9⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        8⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        9⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        9⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        8⤵
        
        PID:18060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9807.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        8⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        8⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        8⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40243.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37403.exe
        8⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24592.exe
        7⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        9⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        9⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        9⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48707.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36808.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        8⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        8⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        7⤵
        
        PID:18332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
        6⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 720
        7⤵
        Program crash
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48920.exe
        7⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        8⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        8⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        7⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11953.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        7⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
        6⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8743.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        9⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        9⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        9⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe
        9⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        8⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39324.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        8⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        8⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        8⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16486.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
        7⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        7⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51795.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        7⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59334.exe
        8⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64151.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20996.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65426.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        7⤵
        
        PID:18376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        7⤵
        
        PID:18120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32563.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        6⤵
        
        PID:17672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        6⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12054.exe
        8⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        8⤵
        
        PID:17808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        8⤵
        
        PID:17572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39617.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        7⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        7⤵
        
        PID:18152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        6⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        6⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44555.exe
        5⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41136.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        8⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        8⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        7⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        7⤵
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        7⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1426.exe
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        6⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        6⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        5⤵
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14368.exe
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        9⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        9⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        9⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        9⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27186.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        8⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        8⤵
        
        PID:17932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        8⤵
        
        PID:17544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51208.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        8⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        8⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exe
        8⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        7⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        7⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        6⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 632
        7⤵
        Program crash
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        7⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        6⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        6⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        8⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
        8⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        7⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        7⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        6⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        7⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        6⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        6⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
        5⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        5⤵
        
        PID:17908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45780.exe
        6⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        7⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:18360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
        6⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        5⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        6⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        6⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        6⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
        5⤵
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46913.exe
        5⤵
        
        PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exe
        5⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        6⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        6⤵
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        6⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        5⤵
        
        PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40742.exe
      4⤵
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        5⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48369.exe
        5⤵
        
        PID:17924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        5⤵
        
        PID:17972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
      4⤵
      PID:14500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
      4⤵
      PID:17328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9511.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        8⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37678.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        7⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39946.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56673.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe
        6⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        8⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        8⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
        7⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        7⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        6⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        6⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        6⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4585.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25893.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        6⤵
        
        PID:18068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
        6⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        5⤵
        
        PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9599.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        8⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        7⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        7⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:18352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        7⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        6⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        7⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        6⤵
        
        PID:17768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61639.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
        5⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        7⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        7⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        6⤵
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        6⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        6⤵
        
        PID:18136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        5⤵
        
        PID:5020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 80
        6⤵
        Program crash
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41745.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47872.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        5⤵
        
        PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      4⤵
      PID:16156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17016.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4651.exe
        8⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        8⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45199.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        7⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        6⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3449.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        6⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39858.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        7⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        6⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43981.exe
        5⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        5⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26616.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe
        7⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        7⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45884.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        6⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        5⤵
        
        PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        6⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        6⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        5⤵
        
        PID:16124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      4⤵
      PID:14092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
      4⤵
      PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
      4⤵
      PID:15096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32199.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33384.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        5⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        5⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        5⤵
        
        PID:17692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        5⤵
        
        PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        5⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        5⤵
        
        PID:16532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
      4⤵
      PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      4⤵
      PID:14712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
      4⤵
      PID:18296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16196.exe
      4⤵
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15567.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        5⤵
        
        PID:792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 632
        6⤵
        Program crash
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        5⤵
        
        PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
      4⤵
      PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
      4⤵
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
      4⤵
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
      4⤵
      PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exe
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
      4⤵
      PID:11756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
      4⤵
      PID:14960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
      4⤵
      PID:17648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
      4⤵
      PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
    3⤵
    PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41625.exe
    3⤵
    PID:11120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
    3⤵
    PID:14756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65154.exe
    3⤵
    PID:18280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56600.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        9⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        9⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        9⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58898.exe
        8⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        8⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48899.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        7⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
        7⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        7⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
        6⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        6⤵
        
        PID:18368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58712.exe
        7⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33897.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        6⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        6⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        6⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64175.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        6⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
        5⤵
        
        PID:15532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe
        8⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        8⤵
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        7⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38270.exe
        6⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        7⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50352.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        6⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29161.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        7⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        6⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        6⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51161.exe
        6⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29525.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        6⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        6⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        5⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        5⤵
        
        PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        5⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        5⤵
        
        PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        5⤵
        
        PID:7144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 604
        6⤵
        Program crash
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        5⤵
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
      4⤵
      PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        5⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5545.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        5⤵
        
        PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
      4⤵
      PID:10148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50232.exe
      4⤵
      PID:16724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        7⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        8⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12441.exe
        8⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        8⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        7⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42650.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        6⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        6⤵
        
        PID:17412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        6⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        6⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30001.exe
        5⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        5⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
        5⤵
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        5⤵
        
        PID:18224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        5⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        5⤵
        
        PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
      4⤵
      PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
      4⤵
      PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
      4⤵
      PID:17728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
      4⤵
      PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        6⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16486.exe
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exe
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        5⤵
        
        PID:17580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
        5⤵
        
        PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
      4⤵
      PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
      4⤵
      PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
      4⤵
      PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        5⤵
        
        PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
      4⤵
      PID:13068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
      4⤵
      PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
      4⤵
      PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
      4⤵
      PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
      4⤵
      PID:9856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
    3⤵
    PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
      4⤵
      PID:13556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
      4⤵
      PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
      4⤵
      PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
      4⤵
      PID:7708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
    3⤵
    PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
      4⤵
      PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
      4⤵
      PID:8796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
    3⤵
    PID:9096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
    3⤵
    PID:12848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
    3⤵
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
    3⤵
    PID:18104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
    3⤵
    PID:15972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
    3⤵
    PID:8992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53704.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        9⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        9⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        9⤵
        
        PID:17232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24710.exe
        9⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        9⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        8⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        8⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        7⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4745.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        7⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 460
        8⤵
        Program crash
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56673.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        7⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:18324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        6⤵
        
        PID:17532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        7⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        7⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        6⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        5⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        5⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        5⤵
        
        PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56673.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        7⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:18316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14352.exe
        6⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        5⤵
        
        PID:12444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
        5⤵
        
        PID:17576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        5⤵
        
        PID:16604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
      4⤵
      PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49529.exe
        5⤵
        
        PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
      4⤵
      PID:13468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22790.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4745.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        5⤵
        
        PID:17696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        5⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        5⤵
        
        PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42554.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
      4⤵
      PID:14380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      4⤵
      PID:17612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
    3⤵
    PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        5⤵
        
        PID:17784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      4⤵
      PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
      4⤵
      PID:15152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
      4⤵
      PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
    3⤵
    PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
      4⤵
      PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        5⤵
        
        PID:16628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
      4⤵
      PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
      4⤵
      PID:17792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exe
    3⤵
    PID:8328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26364.exe
    3⤵
    PID:11480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
    3⤵
    PID:14608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
    3⤵
    PID:17772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
    3⤵
    PID:16688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        6⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14241.exe
        5⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
      4⤵
      PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
      4⤵
      PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11483.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      4⤵
      PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        5⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exe
        5⤵
        
        PID:17312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        5⤵
        
        PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
      4⤵
      PID:13108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
      4⤵
      PID:16588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
    3⤵
    PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5531.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
      4⤵
      PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
      4⤵
      PID:17568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
    3⤵
    PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
      4⤵
      PID:12916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
      4⤵
      PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
      4⤵
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
    3⤵
    PID:9456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
    3⤵
    PID:13092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
    3⤵
    PID:16400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
      4⤵
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        6⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37678.exe
        6⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36070.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      4⤵
      PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
      4⤵
      PID:13552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
      4⤵
      PID:16108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
    3⤵
    PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
      4⤵
      PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
      4⤵
      PID:11180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
      4⤵
      PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      4⤵
      PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
      4⤵
      PID:8060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45495.exe
    3⤵
    PID:10124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
    3⤵
    PID:13600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
    3⤵
    PID:17952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
    3⤵
    PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54696.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        5⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
      4⤵
      PID:13100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
      4⤵
      PID:15920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
      4⤵
      PID:17920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
    3⤵
    PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
    3⤵
    PID:10816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
    3⤵
    PID:13096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
    3⤵
    PID:16484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
  2⤵
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
    3⤵
    PID:2212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 604
      4⤵
      Program crash
      PID:15460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    3⤵
    PID:9684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
    3⤵
    PID:12492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
    3⤵
    PID:15676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
  2⤵
  PID:7512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
  2⤵
  PID:9656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
  2⤵
  PID:13544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
  2⤵
  PID:17096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
  2⤵
  PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3108 -ip 3108
1⤵
PID:6220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4536 -ip 4536
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7144 -ip 7144
1⤵
PID:11120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 792 -ip 792
1⤵
PID:8020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2212 -ip 2212
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11415.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
Size 184KB
SHA256 da079397160d49e86d5e81a5b8116d8ee513f89cb9929d55bc28ba07be9da33f
MD5 567b1ccfbefb50c39da3de490c867c7e
SHA1 c159881dd68c998c5be244156a0cfd9903839e17
SHA512 c5953a0998e46c14fb9445ebc51895a24307cbac14d243a4e0e424a57a22be701a5e4918b53d658e32af7600b0ac5da46159068146947baee1def820ebc7a5d4
SSDEEP 3072:YNa23RoAOXRNZRUNWSrFU9HzeAvnqnxiuR:YNJodvRUVUNzeAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-12863.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe
Size 184KB
SHA256 7437f9caaccb94371cba6eb0968085506f9b57961300e968f55f9faaed73c09a
MD5 b9a598143a4642feab2fe19239a4b413
SHA1 0c1ed473fa73794fe403f78ff0373011c7634dd7
SHA512 f9a7433b6d51fd9f0789e16960a3d335cb6da6b8a5e3108cebb033c0a161658656705497b2370bb53ee3c3751730d805b81fd6da7a3ffa4b948d6bcb438c3327
SSDEEP 3072:YNw2iRoAOXRNZRUNWSBFU9HzeAvnqnxiuR:YNaodvRUvUNzeAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-18165.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
Size 184KB
SHA256 a26f26826db28b362449f69f58154590a87d31c79c0c02e4d5ee8d2ec9c6d2aa
MD5 fcf9cc12f45a1cd04ca6e730407b9acb
SHA1 7217f632968c71e81a73b767bcc33237c947a4f2
SHA512 fe2ab4e7982ad68f18f9764921e0853312ecc2fa17f22d51c1d1f496d68ae14330abd9e84dcdaedb5ca87e117ed94a2c6a4d142bda2a942989e1191fc8a6e95f
SSDEEP 3072:YNa23RoAOXRNZRUNWSrFU9HzeAvnqnxiuR:YNJodvRUVUNzeAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27228.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
Size 184KB
SHA256 f276231416ab67ee764185808fcf598fdf921af4ddd50df9d3aad3eeaf5a5115
MD5 b245e3c3175c8e08bcb962f1a7a8b371
SHA1 04886de32cade651708c6aa7fb1068e265de8914
SHA512 db3009bf195281d3b3a34f900722e69de1069d2865e5047f6ae285f4b4a678e0030cc11126e9afb278011807bfe10b72c0cc80a6ad5c208f95bfbc4c9fc83dad
SSDEEP 3072:YNa23RoAOXRNZRUNWSjFU9H4MAvnqnxiuR:YNJodvRUNUN4MAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27337.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
Size 184KB
SHA256 3dbd20b49cd3d2f82887fffc13089f400b27969e1573b7b4bc51b8a8617dd394
MD5 f220f8b202e8ac65c0cb08e4dcc0fa0b
SHA1 ac47e6f6e70042f55589649304886eeee083b65a
SHA512 0e8d97d6db5d802dadfe975de83ed997fdd4758cc385a8865b5f20779bdab76d9a2a507e01b5c62e5b09fe711f2ecdee9036363b642c54c9df7724a8fe2471db
SSDEEP 3072:MNw23RoAOXRNZRUNWSrFU9HS7AvnqnxiuR:MN7odvRUVUNS7APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32199.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32199.exe
Size 184KB
SHA256 7f9917e6eb79834e339edc884429ee358576da03fe5962ed5e269ba8dea9422f
MD5 d962feb3a932d693d906b17ac84368ef
SHA1 08fa28dba7d833a6d55e883f30bf73183971b991
SHA512 213316d92f572a2a4efb6761dbba1544ce8183c862588af0890a938507b7fb2b39fe7dd3b27773ef530f93503c1e9b41523e829673b2ddee1e343fbe70470960
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzdAvnqnxiuR:YN7odvRUVUNzdAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32464.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
Size 184KB
SHA256 076624745ee324023adac0f7a64964973d7855984fc4235ac51b228cba546a07
MD5 acb038ff0c8e461f256071a035a9125a
SHA1 d345d286dc0af16d412554c373ebbdfc40351bfb
SHA512 f33cde18be79817dad35c8f47ccef68a7a430ab3df209fbce2ebf6265cbb051fce7800b9b7720c43508b4a625361829b0f2889dba3434c05f7f7eb8917fa2f38
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU90zZAvnqnxiuR:YN7odvRUVUuzZAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32656.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
Size 184KB
SHA256 f02a30664cd58abf03b1eb329e3bad1ec2abd40e5df5452690d580771310be56
MD5 3058eb2363b23b42ee1918ed81a49d51
SHA1 999427b428565ed2ef8b58e4be9fab8462e45911
SHA512 dc8ee4c8beb222b083867b74f841850d20592c1b673e9cc27f5efae2c3f5099e7b5c24bfe905e89ac228a5d48945109463a951eebfa1b9b567df76e33a6f386a
SSDEEP 3072:YNa23RoAOXRNZRUNWSrFU9jzgAvnqnxiuR:YNJodvRUVUhzgAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34140.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
Size 184KB
SHA256 878d53d8653c3459b2a97b8ec579533c6c0a0b27f70e95be7d8a9894d0fc6078
MD5 5637117049541378522f09d37027e6cf
SHA1 a0ceabbeea6841ec511e9eaf4ad4857bd392c0ef
SHA512 2b027dbb81fc98ccabad0e2bd741c1bf73778239fb3b727278344fece53f442a33671d66be3507f5d5bec78b0f6cd1e586909f909f2698d367715214f4b5454f
SSDEEP 3072:YNa23RoAOXRNZRUNWSrFU9H4eAvnqnxiuR:YNJodvRUVUN4eAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36910.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
Size 184KB
SHA256 a8ccdc8f1e5b72917112a5874afa3d3fee56825ed6d25d245b97ad339562660f
MD5 dea0a2c66b606eb73711a3b5acd19e7e
SHA1 1366cc9f3b5245b1fd1adb77e04ed8b47a921167
SHA512 888fbdd58a2a056ba85ef342f828e6c527264760996aea1bcf54565bfd92fdf6cadaca2f4a080b745878c7f208f7b339bc1f5fc8cd8ef5b8bb1ab1ddaf22c0bb
SSDEEP 3072:YNf23RoAOXRNZRUNWSrFU9Hz3AvnqnxiuO:YNQodvRUVUNz3APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-37102.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
Size 184KB
SHA256 c350c167cee299da975bcef84dd3b8f6a3cc21dfcc8e46be104c95c805914bb7
MD5 14edcdce5092233b3edc5bc54ad943f0
SHA1 160a9f40f0cba939ed09f9ae8c647ce6c0126d60
SHA512 a1ad613b5c5c8029f9ac506fcfc3f78b46037df9cabb9b776509ebdacf43f052e1883a86e1ac5bd28cac2ee71bf1f3e22ff6e0441a55ea2e9073bebb0dfee368
SSDEEP 3072:YNw23RoAOXRNZRUNWSBFU9HzeAvnqnxiuW:YN7odvRUvUNzeAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-37103.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
Size 184KB
SHA256 dd85dc7d02928e28e3f3b432682a9243b4ed5d954ec55d62fb4d136fc2691426
MD5 8a7b30e4d9dd494ea7e0ab790558a307
SHA1 b6cf2e8f69e44f35149be3179a743836f0c32c2f
SHA512 28215cc2112baf3a5301d471b9a11231d83e167f30a282492752960a65941c98151451443ee262301f2814bf467182384bc8e5411da035457979775c74baec77
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzxAvnqnxiuR:YN7odvRUVUNzxAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-37368.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
Size 184KB
SHA256 c510415e7766886db374dea44eb6a9ab75bbf5491878e8997b595e40680e1ac7
MD5 85cd8dce80160a249edfa502b46dc558
SHA1 f2e1ccc56bdc47e13c4dfdbcfc0121a98902ac2c
SHA512 0a4f2225e0851af7806da84c787aea4c97856f27d1b55564b2c1be33e0c5d63e1cdc4ef7d3402ca9255bf81f4e7dbfd6f887abeb34c1a25d59b14074239d1c8b
SSDEEP 3072:YNf23RoAOXRNZRUNWSrFU9HzyAvnqnxiuR:YNQodvRUVUNzyAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38394.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
Size 184KB
SHA256 6766dc4827a576f0757f58f6dc66be8c3cd3bef5d635c5d3ff8926bf6eda8d77
MD5 e862dde6d1053948786065c09a70b95e
SHA1 a920a3615ad77766f04db164df3c41dd27a977b3
SHA512 7ac10954afdfbea677b7e6860d2012fdf2dbe8b2b61c783c32e00d3fd94b429e0d26d9e2397c4891a6fd7455b945ba3ca4370f72b5bb108dee9d6143239b8873
SSDEEP 3072:YNf23RoAOXRNZRUNWSrFU91z3AvnqnxiuR:YNQodvRUVU/z3APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3875.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
Size 184KB
SHA256 eb4a6437f6b1e78b41873c4d1876e770df421623b93eb39e5480f1daacda4226
MD5 281715061f7d063810b399a5cbaeb01d
SHA1 5206c92b2485bbd67512ffe98970e9b29abf17b3
SHA512 07d1683919388d553c37977c30475bd4515b3c9cd63b4b625c730643691c6600377b80d245da78a26b4a8ab8a7c5398be9918eaf7e156f31907fdf08d4864a6e
SSDEEP 3072:YNw2iRoAOXRNZRUNWSBFU9HzeAvnqnxiuE:YNaodvRUvUNzeAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40632.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
Size 184KB
SHA256 e329959572567e7cd3fbed01af4b8861cd5c4f4119870d60b225b5ad6d06ff57
MD5 4dc21ec26849ecee49c7babc62da76b3
SHA1 b3f1fc23bcfc832486b4ad07cd5448699375d683
SHA512 ba0af3160e35acd24c0fd8dfcf8ac43fe4c92074328980357f02217b0b3b6708e28f2e3709a08c5a853bea43656e31f4842fad2287866e289c3ab1c57cf72369
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzFAvnqnxiuR:YN7odvRUVUNzFAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41644.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
Size 184KB
SHA256 33538999cd6893899ac6d91330f8839d77d0f971c6646b58bfc63ef08af08635
MD5 6a2ba83f2891c32d28c55428a4fc3f11
SHA1 aa59cbaa4032696ace04ee035863ec6bce1f8cf2
SHA512 b82e8bc7ed3c3da571e018bb6c1e9a5e74932dc3416ec173f6f9c3ae8e3ec78ccef4a2c16e38e7e8c238ee3d12ceb6ab47e4c7ee7846ac9a505ff7655d27488b
SSDEEP 3072:YNa23RoAOXRNZRUNWSrFU9H4MAvnqnxiuR:YNJodvRUVUN4MAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41976.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe
Size 184KB
SHA256 9cd3fc0d3c6e752b95391f0f4c38b07bfb5d835d5e3f921168f34c85520f1297
MD5 405c722c6532bb4debf4dd470fe247f3
SHA1 2914b12a1a7d6557b9a01406a490d4482b3e6e4e
SHA512 5c1b9dfc9346c72303c1c009a48301a6f8609ebac826fc54f4a1d6a452ee42f8febf26545053a8a0ca39b88243dfba66ed632aa9c862874aecf320fbb487cbc4
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzeAvnqnxiuR:YN7odvRUVUNzeAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-4238.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
Size 184KB
SHA256 17fb52046fdd9c8984fd97c7d3b98ab674e9da764f77795a5ce3d6e289e6c2a8
MD5 8db037275f1ce26ec82a82d738afaa4c
SHA1 4ae4207930ba29f4c6cf8184c3f884be6169ce99
SHA512 f83e039e82a9b12f3078b20a3d1c1b7626f10c85e6d12a7e6ade429943a302eb19a93c495c834aec0d76fcacb29f257b1b01252f9ac2e467487149caadc8335f
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzFAvnqnxiuR:YN7odvRUVUNzFAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43762.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
Size 184KB
SHA256 182e59ae39ddb42bf112f931a9ede0476e1e3ffa46eb3c66443187cd51e9982b
MD5 ba37be1d25a3d7b90cb241c6c6cc7b27
SHA1 3ee2b1d2d576b6b040e1e20ba296bd855faf769a
SHA512 c0b2e62564d7a3260e721a3b6aea012ca301b86ab86eea09bf8c8e513a2959c7930a941d1a7ac0d808b1d76d50311c74d99c45d0977841da27239da0c53fb503
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzaAvnqnxiuR:YN7odvRUVUNzaAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44161.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44161.exe
Size 184KB
SHA256 0a6075b7cf594f34dd7e84f7685cf04072580ceeb79e98dff5ae4096fef65ffc
MD5 147ad079740953670354cb7059669bdb
SHA1 f935c5a613c3eac3eeb8d05028adfc9488e58c01
SHA512 e78577e90ed5414d811cac7997550c6d4a39ec3ee2705c42246359085025e41b26af5587780532119cade9c0554e8ad37322f9353c3f895239f5169b036b63df
SSDEEP 3072:YNa23RoAOXRNZRUNWSjFU9H48AvnqnxiuR:YNJodvRUNUN48APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44835.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
Size 184KB
SHA256 59f3adbf724f5caa45a36c65ae55e886053317f5cec48c197b13e5e519a4ea3c
MD5 f0092c9d75372bf51af4e5a89a0087bb
SHA1 b5f0da2d37cea44ee023cd9f6ce587164cfe2d84
SHA512 7ba44bac64050c9b34876591b605ea66a2e0f018628e04d84054e52bf374b20b7e6349fbbf81d0dd3a5e33049113638f2993c722526b4a3758d0b379fcd7b959
SSDEEP 3072:YNf23RoAOXRNZRUNWSrFU9Hz3AvnqnxiuR:YNQodvRUVUNz3APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47574.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
Size 184KB
SHA256 4059101100efc26f10dbc101b189c0497e0cb57dccdd2006e0796a53564946b9
MD5 291d7a38085c2134692a442a22558404
SHA1 f8a81c310eb4c4a9ea89f4375b4110f0a21ce1dd
SHA512 4eb95b24f969dd0ae90bb9663a103eaee3a63b3c3fa7d8a5f377469fb52e4792b708f075cf97bd6ce870d5ad9484add0b234d7b73672b0871419a65cec4c343b
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzxAvnqnxiuR:YN7odvRUVUNzxAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50612.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
Size 184KB
SHA256 e42bb98578d39ab1d3452beaba8372c40ef6f5b60ab0021c4914251c0f0cb2f9
MD5 a3b579183f38df542c665d423e6abb7c
SHA1 16b06f33f641ffce1dda88403ecb8104f3e477c4
SHA512 71ab1bfa0e7dd3d724fae397b1b2c2f59756282e8d7133ddd98927e0dced850a85bd1695b2e46aba52decdc68efa66ebfd10cd8f83ce5cac06d3dea849bd5897
SSDEEP 3072:+Nw23RoAOXRNZRUNWSrFU9HzBAvnqnxiuR:+N7odvRUVUNzBAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52287.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
Size 184KB
SHA256 16c3fce5cdcc0d6fba87848d14383988afd33607f69d880934599323631db3c1
MD5 e7951990067ff8fd73dc90c5a9207079
SHA1 a0485e6c9c7f46b20061d17c7ea80511b347c7dd
SHA512 86f264d68d5f5971c2cc51a77f096e7a857b172ad22cdfce09db9cdaa5edd31710df6649718ec1918dc56fe3eed18d9118fedf94564eb55151e5f92e3decd3d9
SSDEEP 3072:YNa23RoAJXRNZRUNWSrFU9H4eAvnqnxiuR:YNJo+vRUVUN4eAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52692.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
Size 184KB
SHA256 3c6b3882da3c75704f0c8a2c79b2a2218630b7fdd7ba495eea2154015def55d1
MD5 94b60d869a639e05a87ad136bb0b6dba
SHA1 835fb593ad4e98b07b8218c96a601227d959f1ab
SHA512 dbcc7aadaf66687f814eef6d735ee26a31dfef2b71e4e4f4598225f3fb30f4cf84583a76973b3d925500fe16e854440a2d9f73191c04be7680ffae212a3612f4
SSDEEP 3072:YNf23RoAOXRNZRgNWSrFU9Hz8AvnqnxiuR:YNQodvRgVUNz8APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5359.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
Size 184KB
SHA256 1f94eafcbfc927895dcf772f5b75b1b56675703e42ed7e1d7013d8f019caccf5
MD5 36c7699e6c469bd39996b1544ac1cea2
SHA1 f1958497cc48925b07d8f9abc4eddb90d77e4953
SHA512 20cfb8ca2e5166ee61b0d6c0b6d9a3416461e8e302dda4765719200888ccf84c69f6eafbabb2e9a07eb3acd99c7b25821c6af9561e5374f8a48d99e68845c672
SSDEEP 3072:YNf23RoAOXRNZRUNWSrFU9Hz3AvnqnxiuR:YNQodvRUVUNz3APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53704.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53704.exe
Size 184KB
SHA256 0ab0993dc5dacbb68113501c070322fec49ed032243f4d575e0c16c44b0e8d6c
MD5 428e3e27267708e4d2059d80558fbfa5
SHA1 9c55987e2da9563d4e0542f0eaef5c930be43574
SHA512 8782063d6aa9620c3bf0aed2033918f5d65674a9c12dbfa5b4b8580432b5e108f43c4eb18c9cc711e65f1c1333a2961ffc62efbd9b0175a47cfe4159cc83e974
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzZAvnqnxiuR:YN7odvRUVUNzZAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5442.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
Size 184KB
SHA256 111232a3c2b09ca634eb739f2ac2fb4a41b9e1a1ebbe1d8d3c5efe5bb666fc7e
MD5 987b1ef12616f102903eb4b5ad00e309
SHA1 7900189d249a25bb658d02ec3c51ce19ff6db235
SHA512 743eedb8f4cebc8e7d8a48387460e181de97cce8c0164a618f25b1bad39211e50795eea8be37fcb506b2d223ea19d67919485d32a77319ff63579771021b7e7b
SSDEEP 3072:YNa23RoAOXRNZRUNWSrFU9HzgAvnqnxiuR:YNJodvRUVUNzgAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-55689.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
Size 184KB
SHA256 afbbdb934d9464292bcf618fa6a71acbfeaa9a80f071da0d6efd0716f6eac1f0
MD5 09dfc981e3314e9c444d83cbf223c84e
SHA1 2bfb700f9e9054a5c1688f2d74b14a3eb089b5bb
SHA512 a97c9936c15584559d12dc64a6e84370639b159553ae073bf4f768098b5f1e250f575c9334dafb0372b084ca1fb2d7cfe3a9ee7f4e6cbb5edef50889d7a2b0b5
SSDEEP 3072:4Nw23RoAOURNZRUNWSrFU90zLAvnqnxiuR:4N7oOvRUVUuzLAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-58343.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
Size 184KB
SHA256 ab0de2b062807bdb1b4d1060d151da608d18ca8152db9b4f1bd1ad6e55bd3e9b
MD5 c9e84aed517747ed6c4f471c7ed9abd3
SHA1 7b982722a55e33087c1f60ab0ddaaf11ca180dc8
SHA512 b955f60e582c75d63deddd57128f5f93baadc3ac421016b4ce8d07d4cf05f0e5c21d264160f58761c729d73585be78299cdf2efc0968751e1ce487177872f163
SSDEEP 3072:YNf23RoAOXRNZRgNWSrFU9Hz3AvnqnxiuR:YNQodvRgVUNz3APqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-60682.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe
Size 184KB
SHA256 a855c6af0f189e64c0ffb302096f7962b604f8fa8aa30caba63f2e82718e52f5
MD5 a249f4bec1e31cf898a2ff4c998be526
SHA1 17f1e14dd666e2f070edc8f83604dd540a010273
SHA512 851e1a95f8bae3cf6ed6adfb8d6b3116435c900d38e6289b2f9781e60de779cf0fd1e46f3ffb7842b49018508464f101da1fc5e53a3b6298c94ed0245c8688ae
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9HzLAvnqnxiuR:YN7odvRUVUNzLAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63283.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63283.exe
Size 184KB
SHA256 00e00c607bf4557de3da171fa857ed4fee87040e43f17c83972e6e2ccc999cc6
MD5 f21d13fcd0daaea095b1d1849f9912c2
SHA1 b56ce7dfbafbd4185d78a2b30336ed58e362f45f
SHA512 d5ff5cf5b18a1962e61399deccf9067a74589ee45bf7aa821956e0fd2a4353ce0166cd7b7b952630e565bc4ff7f9141500732ab4b10ee1b33cab78b4cc0dc5b1
SSDEEP 3072:YNw23RoAOXRNZRUNWSBFU9HzeAvnqnxiuR:YN7odvRUvUNzeAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65136.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
Size 184KB
SHA256 7930f58adc3fd401988f0de68cd94f7c0579c756d12ba45f0f42cfe32616b5a3
MD5 132f6ae198bd8cd72e0363a27d181223
SHA1 f80dd27a8673066f9458e52a3b6eaa9b153a3e53
SHA512 543bce957fdf81b5b2f58c82337b088f31e0b432bdc47581cbd2c221385b9515a1415c49189288e2eff66e50174d6833fa08e606865bbf9966c0899b99610df9
SSDEEP 3072:YNw23RoAOXRNZRUNWSrFU9Hzx9vnqnxiuR:YN7odvRUVUNzx9Pqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7273.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7273.exe
Size 184KB
SHA256 2e9acfc9789dc56264e38443f59a78320b4fe2a37efb1e5ac90f41928202ba4c
MD5 14e69e74073b096cc7da38f233342629
SHA1 af9a983ac5879d1c0541c913afa1e52cc700897f
SHA512 3f69b881fbcf5255d02f796ef95da24502e2651ab5cbc623455a3b68d2a84eddcac3db0bfc49510b022619f2f5f2ad181c86cbfc1ec4daf3864e57856065727d
SSDEEP 3072:uNw23RoAOXRNZRUNWSBFU9HceAvnqnxiuR:uN7odvRUvUNceAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7767.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe
Size 184KB
SHA256 66b79bedfcf42d10d0d18af07c9f1cbccbcdea88bdbaca6076023e577773678b
MD5 92c912c7c93fd6402e8f8f3ed94c8b24
SHA1 981ef67993ee9fef28027c6e6f1e0a0c5996ab13
SHA512 6130d2f77b9db060e900d34667e03ca6daee0576ded1aba1e52e5976027c656442134181c4adcff3e0d4cc413610551229a998d167b5b59caf1ec136b1bd363b
SSDEEP 3072:TNf23RoAOXRNZRUNWSrFU9HzyAvnqnxiuR:TNQodvRUVUNzyAPqnxiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads