1377b70affdda8c0bd21f33706c6468cbf5fab4f756f74fd71b0037dc1cf9538

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe
Size

468KB
MD5

74d4252d8832364f5968e75a4ed5eec0
SHA1

ec1eb252de15108edc57c10767f115af84c0abd2
SHA256

1377b70affdda8c0bd21f33706c6468cbf5fab4f756f74fd71b0037dc1cf9538
SHA512

809e7a1f06d791886c5878604ee68751d2b723b9beb177bffbeb39ae345b1861bef722385b1425cae40ff172c804d5d724b8672c5d60affdcc9753dd81f6df2e
SSDEEP

3072:ibAUogIdId5UtbYJPztjcf8/hCtvPIpwnmHexVhjfab8qS70XFlY:ibHowbUtOPJjcfJ0KNfaI170X

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3492	Unicorn-53834.exe
2768	Unicorn-61016.exe
1464	Unicorn-6340.exe
2192	Unicorn-44426.exe
2920	Unicorn-34120.exe
3840	Unicorn-58716.exe
4528	Unicorn-20476.exe
4492	Unicorn-43248.exe
2836	Unicorn-43803.exe
3876	Unicorn-28858.exe
372	Unicorn-56823.exe
1528	Unicorn-5021.exe
2132	Unicorn-10886.exe
60	Unicorn-40870.exe
2460	Unicorn-40870.exe
100	Unicorn-20280.exe
404	Unicorn-57783.exe
1476	Unicorn-51582.exe
3716	Unicorn-54275.exe
2760	Unicorn-12687.exe
5100	Unicorn-31061.exe
400	Unicorn-57704.exe
4068	Unicorn-37192.exe
2200	Unicorn-2381.exe
1900	Unicorn-37192.exe
2000	Unicorn-16009.exe
4580	Unicorn-24675.exe
4744	Unicorn-19486.exe
1916	Unicorn-19486.exe
4216	Unicorn-9271.exe
1572	Unicorn-9271.exe
1364	Unicorn-19294.exe
1556	Unicorn-56797.exe
2540	Unicorn-41852.exe
2472	Unicorn-64310.exe
1540	Unicorn-46512.exe
4156	Unicorn-12064.exe
4880	Unicorn-52926.exe
4084	Unicorn-53481.exe
2792	Unicorn-34452.exe
1452	Unicorn-26284.exe
4660	Unicorn-48742.exe
3964	Unicorn-26838.exe
3548	Unicorn-42620.exe
4308	Unicorn-36398.exe
2524	Unicorn-27628.exe
2748	Unicorn-56159.exe
2016	Unicorn-24115.exe
4500	Unicorn-33046.exe
1328	Unicorn-28230.exe
2704	Unicorn-26559.exe
2280	Unicorn-27893.exe
428	Unicorn-46474.exe
2132	Unicorn-49766.exe
2400	Unicorn-49766.exe
3160	Unicorn-43544.exe
2508	Unicorn-55796.exe
840	Unicorn-27762.exe
4576	Unicorn-2511.exe
1352	Unicorn-63964.exe
3208	Unicorn-53658.exe
1132	Unicorn-2246.exe
2848	Unicorn-27016.exe
3312	Unicorn-7150.exe

Program crash 20 IoCs

pid	pid_target	Process	procid_target
2404	2132	WerFault.exe	108
1956	2132	WerFault.exe	108
6076	2200	WerFault.exe	120
5200	2016	WerFault.exe	152
6080	4500	WerFault.exe	153
6036	2200	WerFault.exe	120
7724	7188	WerFault.exe	297
2904	4500	WerFault.exe	153
4468	5384	WerFault.exe	176
9792	5828	WerFault.exe	189
11008	5412	WerFault.exe	227
11092	5296	WerFault.exe	228
11232	5828	WerFault.exe	189
9148	6968	WerFault.exe	253
13888	6968	WerFault.exe	253
16096	9140	WerFault.exe	702
4428	12440	WerFault.exe	812
4464	14476	WerFault.exe	746
16440	11836	WerFault.exe	1075
12876	15820	WerFault.exe	861

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7016	dwm.exe
Token: SeChangeNotifyPrivilege	7016	dwm.exe
Token: 33	7016	dwm.exe
Token: SeIncBasePriorityPrivilege	7016	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe
3492	Unicorn-53834.exe
2768	Unicorn-61016.exe
1464	Unicorn-6340.exe
2192	Unicorn-44426.exe
3840	Unicorn-58716.exe
2920	Unicorn-34120.exe
4528	Unicorn-20476.exe
4492	Unicorn-43248.exe
2836	Unicorn-43803.exe
3876	Unicorn-28858.exe
1528	Unicorn-5021.exe
372	Unicorn-56823.exe
2132	Unicorn-10886.exe
60	Unicorn-40870.exe
2460	Unicorn-40870.exe
100	Unicorn-20280.exe
404	Unicorn-57783.exe
1476	Unicorn-51582.exe
3716	Unicorn-54275.exe
2760	Unicorn-12687.exe
5100	Unicorn-31061.exe
400	Unicorn-57704.exe
4068	Unicorn-37192.exe
1900	Unicorn-37192.exe
4580	Unicorn-24675.exe
2000	Unicorn-16009.exe
2200	Unicorn-2381.exe
1916	Unicorn-19486.exe
4216	Unicorn-9271.exe
4744	Unicorn-19486.exe
1572	Unicorn-9271.exe
1364	Unicorn-19294.exe
1556	Unicorn-56797.exe
2472	Unicorn-64310.exe
1540	Unicorn-46512.exe
4156	Unicorn-12064.exe
4880	Unicorn-52926.exe
4084	Unicorn-53481.exe
2792	Unicorn-34452.exe
1452	Unicorn-26284.exe
4660	Unicorn-48742.exe
3964	Unicorn-26838.exe
3548	Unicorn-42620.exe
2280	Unicorn-27893.exe
2524	Unicorn-27628.exe
2748	Unicorn-56159.exe
2704	Unicorn-26559.exe
2016	Unicorn-24115.exe
4500	Unicorn-33046.exe
1328	Unicorn-28230.exe
428	Unicorn-46474.exe
4308	Unicorn-36398.exe
2400	Unicorn-49766.exe
3160	Unicorn-43544.exe
2132	Unicorn-49766.exe
2508	Unicorn-55796.exe
840	Unicorn-27762.exe
4576	Unicorn-2511.exe
4036	Unicorn-16902.exe
1132	Unicorn-2246.exe
2848	Unicorn-27016.exe
3208	Unicorn-53658.exe
1352	Unicorn-63964.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3492	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	89
PID 1216 wrote to memory of 3492	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	89
PID 1216 wrote to memory of 3492	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	89
PID 3492 wrote to memory of 2768	3492	Unicorn-53834.exe	95
PID 3492 wrote to memory of 2768	3492	Unicorn-53834.exe	95
PID 3492 wrote to memory of 2768	3492	Unicorn-53834.exe	95
PID 1216 wrote to memory of 1464	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	96
PID 1216 wrote to memory of 1464	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	96
PID 1216 wrote to memory of 1464	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	96
PID 2768 wrote to memory of 2192	2768	Unicorn-61016.exe	98
PID 2768 wrote to memory of 2192	2768	Unicorn-61016.exe	98
PID 2768 wrote to memory of 2192	2768	Unicorn-61016.exe	98
PID 1464 wrote to memory of 2920	1464	Unicorn-6340.exe	100
PID 1464 wrote to memory of 2920	1464	Unicorn-6340.exe	100
PID 1464 wrote to memory of 2920	1464	Unicorn-6340.exe	100
PID 3492 wrote to memory of 4528	3492	Unicorn-53834.exe	99
PID 3492 wrote to memory of 4528	3492	Unicorn-53834.exe	99
PID 3492 wrote to memory of 4528	3492	Unicorn-53834.exe	99
PID 1216 wrote to memory of 3840	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	101
PID 1216 wrote to memory of 3840	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	101
PID 1216 wrote to memory of 3840	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	101
PID 2192 wrote to memory of 4492	2192	Unicorn-44426.exe	104
PID 2192 wrote to memory of 4492	2192	Unicorn-44426.exe	104
PID 2192 wrote to memory of 4492	2192	Unicorn-44426.exe	104
PID 2768 wrote to memory of 2836	2768	Unicorn-61016.exe	105
PID 2768 wrote to memory of 2836	2768	Unicorn-61016.exe	105
PID 2768 wrote to memory of 2836	2768	Unicorn-61016.exe	105
PID 2920 wrote to memory of 3876	2920	Unicorn-34120.exe	106
PID 2920 wrote to memory of 3876	2920	Unicorn-34120.exe	106
PID 2920 wrote to memory of 3876	2920	Unicorn-34120.exe	106
PID 1464 wrote to memory of 372	1464	Unicorn-6340.exe	109
PID 1464 wrote to memory of 372	1464	Unicorn-6340.exe	109
PID 1464 wrote to memory of 372	1464	Unicorn-6340.exe	109
PID 3492 wrote to memory of 1528	3492	Unicorn-53834.exe	107
PID 3492 wrote to memory of 1528	3492	Unicorn-53834.exe	107
PID 3492 wrote to memory of 1528	3492	Unicorn-53834.exe	107
PID 1216 wrote to memory of 2132	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	108
PID 1216 wrote to memory of 2132	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	108
PID 1216 wrote to memory of 2132	1216	74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe	108
PID 4528 wrote to memory of 2460	4528	Unicorn-20476.exe	110
PID 4528 wrote to memory of 2460	4528	Unicorn-20476.exe	110
PID 4528 wrote to memory of 2460	4528	Unicorn-20476.exe	110
PID 3840 wrote to memory of 60	3840	Unicorn-58716.exe	111
PID 3840 wrote to memory of 60	3840	Unicorn-58716.exe	111
PID 3840 wrote to memory of 60	3840	Unicorn-58716.exe	111
PID 4492 wrote to memory of 100	4492	Unicorn-43248.exe	112
PID 4492 wrote to memory of 100	4492	Unicorn-43248.exe	112
PID 4492 wrote to memory of 100	4492	Unicorn-43248.exe	112
PID 2192 wrote to memory of 404	2192	Unicorn-44426.exe	113
PID 2192 wrote to memory of 404	2192	Unicorn-44426.exe	113
PID 2192 wrote to memory of 404	2192	Unicorn-44426.exe	113
PID 2836 wrote to memory of 1476	2836	Unicorn-43803.exe	114
PID 2836 wrote to memory of 1476	2836	Unicorn-43803.exe	114
PID 2836 wrote to memory of 1476	2836	Unicorn-43803.exe	114
PID 2920 wrote to memory of 3716	2920	Unicorn-34120.exe	116
PID 2920 wrote to memory of 3716	2920	Unicorn-34120.exe	116
PID 2920 wrote to memory of 3716	2920	Unicorn-34120.exe	116
PID 3876 wrote to memory of 2760	3876	Unicorn-28858.exe	115
PID 3876 wrote to memory of 2760	3876	Unicorn-28858.exe	115
PID 3876 wrote to memory of 2760	3876	Unicorn-28858.exe	115
PID 2768 wrote to memory of 5100	2768	Unicorn-61016.exe	117
PID 2768 wrote to memory of 5100	2768	Unicorn-61016.exe	117
PID 2768 wrote to memory of 5100	2768	Unicorn-61016.exe	117
PID 1528 wrote to memory of 1900	1528	Unicorn-5021.exe	118

C:\Users\Admin\AppData\Local\Temp\74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\74d4252d8832364f5968e75a4ed5eec0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        9⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10627.exe
        10⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19066.exe
        11⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        11⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        11⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
        10⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        10⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        10⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60050.exe
        9⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        10⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14476 -s 472
        11⤵
        Program crash
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        10⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
        9⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        9⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        9⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16252.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
        9⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        9⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
        9⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59360.exe
        9⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        8⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55063.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        7⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        9⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
        10⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        10⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        9⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        9⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        9⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        8⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23461.exe
        7⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 464
        8⤵
        Program crash
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42800.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
        7⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        9⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        9⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        9⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        8⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56935.exe
        8⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        7⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe
        6⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        8⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        7⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29823.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        6⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        7⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54503.exe
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57783.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        6⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
        8⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        9⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        10⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        10⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        9⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        9⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        9⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        9⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39412.exe
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48265.exe
        8⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        9⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        9⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
        9⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51065.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        7⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60435.exe
        6⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        9⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        9⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        8⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        8⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        7⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
        7⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        6⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        7⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        7⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
        6⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        7⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        8⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        7⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        7⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        7⤵
        
        PID:15820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15820 -s 468
        8⤵
        Program crash
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        7⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        6⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
        5⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10845.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57606.exe
        6⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        8⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        9⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        9⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        9⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        9⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        8⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        8⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37467.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        7⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        6⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        8⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        7⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21835.exe
        7⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        6⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        8⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        9⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        9⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        9⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        8⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
        8⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        7⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        7⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        7⤵
        
        PID:16920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        5⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        7⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
        6⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
        6⤵
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
        5⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        6⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9140 -s 468
        7⤵
        Program crash
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32088.exe
        6⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48795.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        5⤵
        
        PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14623.exe
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        8⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63393.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44386.exe
        7⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61743.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        7⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15124.exe
        7⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
        6⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12462.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
        7⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32200.exe
        6⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        5⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42440.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        5⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27628.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30690.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50159.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        7⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        5⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47273.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        6⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55884.exe
        5⤵
        
        PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
      4⤵
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
      4⤵
      PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64749.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57332.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14623.exe
        9⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        9⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        9⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        8⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47877.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        8⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25955.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20396.exe
        7⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        6⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        8⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        7⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        7⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52541.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
        6⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        8⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        7⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31868.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        6⤵
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8873.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        5⤵
        
        PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        7⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33713.exe
        7⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe
        6⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33189.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
        5⤵
        
        PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2246.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21887.exe
        6⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        5⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        5⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6267.exe
        5⤵
        
        PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        5⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        5⤵
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
      4⤵
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1426.exe
      4⤵
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
      4⤵
      PID:11836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11836 -s 80
        5⤵
        Program crash
        
        PID:16440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        8⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        9⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        9⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        8⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        7⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        8⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exe
        7⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        6⤵
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exe
        6⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        7⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60723.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        5⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        7⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        6⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
        6⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        7⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        7⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        6⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27239.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        5⤵
        
        PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        5⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        6⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        6⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
        5⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        5⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        5⤵
        
        PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
      4⤵
      PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      4⤵
      PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
      4⤵
      PID:14144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-543.exe
        6⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        5⤵
        
        PID:14384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        5⤵
        
        PID:11124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        5⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7454.exe
        5⤵
        
        PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
      4⤵
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        5⤵
        
        PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
      4⤵
      PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
      4⤵
      PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 632
      4⤵
      Program crash
      PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53631.exe
    3⤵
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
      4⤵
      PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
      4⤵
      PID:14708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
    3⤵
    PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24459.exe
    3⤵
    PID:10868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exe
    3⤵
    PID:14456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
    3⤵
    PID:8212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
    3⤵
    PID:12856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52926.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41572.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        9⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        10⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        10⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        10⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        9⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16111.exe
        9⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        9⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        8⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
        8⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        8⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        8⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe
        8⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        7⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        9⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        9⤵
        
        PID:16620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 600
        8⤵
        Program crash
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        7⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16160.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24503.exe
        6⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29346.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        9⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
        9⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        9⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        9⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 636
        8⤵
        Program crash
        
        PID:11008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 648
        7⤵
        Program crash
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21644.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20090.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe
        7⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51939.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        6⤵
        
        PID:17068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        7⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        6⤵
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        6⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        7⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        7⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        6⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7819.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30383.exe
        5⤵
        
        PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        8⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52816.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        7⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        7⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
        7⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        6⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        6⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        7⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        7⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        6⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        6⤵
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        6⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        5⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        5⤵
        
        PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        7⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe
        6⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12440 -s 80
        7⤵
        Program crash
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        6⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43706.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        6⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16330.exe
        5⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
      4⤵
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51065.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3370.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
      4⤵
      PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        5⤵
        
        PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      4⤵
      PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
      4⤵
      PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9726.exe
      4⤵
      PID:11560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        8⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40449.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        7⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        7⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        7⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
        6⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7621.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        6⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        7⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        6⤵
        
        PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        5⤵
        
        PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
        7⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
        7⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        7⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        6⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57451.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        5⤵
        
        PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        6⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        5⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exe
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
      4⤵
      PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
      4⤵
      PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26584.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        7⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        7⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        5⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30975.exe
      4⤵
      PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        5⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
      4⤵
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
      4⤵
      PID:17096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        7⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        6⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        5⤵
        
        PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18005.exe
      4⤵
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
      4⤵
      PID:13232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
      4⤵
      PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
      4⤵
      PID:11668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
    3⤵
    PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30577.exe
        5⤵
        
        PID:11908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
      4⤵
      PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
      4⤵
      PID:1396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
    3⤵
    PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
      4⤵
      PID:7568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
    3⤵
    PID:9980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
    3⤵
    PID:14576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23486.exe
    3⤵
    PID:16396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        8⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        7⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        6⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
        7⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        6⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31139.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        6⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exe
      4⤵
      Executes dropped EXE
      PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        6⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        6⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-543.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        6⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
      4⤵
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        5⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        5⤵
        
        PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      4⤵
      PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1003.exe
      4⤵
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
      4⤵
      PID:10708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55721.exe
        8⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        8⤵
        
        PID:17364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        7⤵
        
        PID:17248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        6⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        6⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        5⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4428.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31139.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:17000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
      4⤵
      PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33746.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
      4⤵
      PID:12188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
    3⤵
    PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        5⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        6⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        5⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
      4⤵
      PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
      4⤵
      PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      4⤵
      PID:17388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4821.exe
    3⤵
    PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
      4⤵
      PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
        5⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        5⤵
        
        PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
      4⤵
      PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
    3⤵
    PID:8508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
    3⤵
    PID:14508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
    3⤵
    PID:5596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33046.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        7⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 636
        7⤵
        Program crash
        
        PID:9148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 636
        7⤵
        Program crash
        
        PID:13888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 752
        6⤵
        Program crash
        
        PID:9792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 752
        6⤵
        Program crash
        
        PID:11232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 724
        5⤵
        Program crash
        
        PID:6080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 748
        5⤵
        Program crash
        
        PID:2904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 724
      4⤵
      Program crash
      PID:6076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 768
      4⤵
      Program crash
      PID:6036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 724
    3⤵
    - Program crash
    PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 716
    3⤵
    - Program crash
    PID:1956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30384.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46619.exe
        6⤵
        
        PID:16896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        5⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
      4⤵
      PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16673.exe
      4⤵
      PID:16536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
    3⤵
    PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      4⤵
      PID:12156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
      4⤵
      PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
      4⤵
      PID:9360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
    3⤵
    PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
      4⤵
      PID:13752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
      4⤵
      PID:16408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
    3⤵
    PID:10936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
    3⤵
    PID:14700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
    3⤵
    PID:10732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46474.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
      4⤵
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
      4⤵
      PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        5⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        5⤵
        
        PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
      4⤵
      PID:13196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
      4⤵
      PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
      4⤵
      PID:16828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
    3⤵
    PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
      4⤵
      PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
      4⤵
      PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
      4⤵
      PID:8708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
    3⤵
    PID:8976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
    3⤵
    PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
    3⤵
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exe
    3⤵
    PID:13656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exe
  2⤵
  PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
    3⤵
    PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
      4⤵
      PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
      4⤵
      PID:17140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
    3⤵
    PID:8380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
    3⤵
    PID:11740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
  2⤵
  PID:8428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
  2⤵
  PID:10004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
  2⤵
  PID:14416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
  2⤵
  PID:8
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
  2⤵
  PID:13260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
  2⤵
  PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2132 -ip 2132
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2132 -ip 2132
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2200 -ip 2200
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2016 -ip 2016
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2200 -ip 2200
1⤵
PID:7068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4500 -ip 4500
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7188 -ip 7188
1⤵
PID:7368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5384 -ip 5384
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4500 -ip 4500
1⤵
PID:7468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5828 -ip 5828
1⤵
PID:8808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5412 -ip 5412
1⤵
PID:10692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5296 -ip 5296
1⤵
PID:10720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5828 -ip 5828
1⤵
PID:11140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6968 -ip 6968
1⤵
PID:11184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6968 -ip 6968
1⤵
PID:12448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 9140 -ip 9140
1⤵
PID:16052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 14476 -ip 14476
1⤵
PID:15844

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe

Filesize
468KB

MD5
58d4d682f01035509c56a136c5cc7713

SHA1
3d1f031e2a79e5052586547f485534bcc1c53e38

SHA256
1aee2033bd2e0f8e5ce2f14c044909461ddf01faac0342ec09f5daa5f4c524f8

SHA512
e0dde99c6b359e0aadf57a3ae8f5628e9641b06e01a64fd9913937d798c713fe582be2d29d06f245287f2a4c8e3b916018ba03542db76e27a0e060e7976c9603

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe

Filesize
468KB

MD5
998c2abf1b2c6d237d7f2b6ccc458529

SHA1
3879813ee3bb543a141e8d92ee8a534324bffa31

SHA256
8f1de1703cc9b19fff8fcae014ecec5fe543f30cd0aa36e0bd8960f580316674

SHA512
14da0848c37d68bb68272c6e770336fbd6f7e4903abdbe1decbad1b42ea48a0976b4e75fa7dca52cfc2a10611240206fca2f7220b6b4817966f2f75dfe8af6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe

Filesize
468KB

MD5
b3f537d260dc973a55056b8a048f3ad2

SHA1
473881a1ed3ba9853406743f95e32bda712b363d

SHA256
b89e1776888deefb40ed0da96b49466aaa24af0eb042a728ccc3b2f991b8f28b

SHA512
36121fc731952b2983e3c7995339ee80c298e221edeab26f458ac3a577c25383bc85fe51ed95d8fc5452cb7dcbd567e55d5aea127b8370f6a74b4e878b988963

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe

Filesize
468KB

MD5
4d4a351134668164e7bfd940ab163c6e

SHA1
1421e1c8575bafc55e5f907a6ef4b6cd8fbfcb6a

SHA256
fff4b6936473360c3677a927749a03e0878956769f24f5417e7696a8b2fe5ce0

SHA512
18c7e9d30e31287cd2889586ffdef969be57bb9ff2e737a26e18e128abb8c2db187b1029ef0d586abe311c0c7e2653aece63df45216b783837d6b2ef5d9bd62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe

Filesize
468KB

MD5
5ba8b02a8650c67c122d733cae4e76a5

SHA1
fdca0f52e5fb262a1a584ce8363883f889bd2376

SHA256
65e211f70e914656842eb90fc7d61bf6e74f7ba081bf064994960ca75ec93724

SHA512
07fcc0c1d8359f3332456cb2f07908e72b8d5356d48d276d3cf8aad635ccfec3001a46cdf4b8fa944233066084e2793d131e771912055aad87844b36844b86d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe

Filesize
468KB

MD5
3b51d38add2d7961dbacf2d463ea1e71

SHA1
5285bcfec51a763c615a1236ec513b97b252c476

SHA256
50cc80e8b7596dfe7a738cb3e694338a8e7397351fd8a80e410c559fd65b307b

SHA512
5589cdf7abfd9ee679de848713a004e66a5f18a8e521305e527403d32059c6d419cd936319a48008013fd5014689460e1e7ea881cb7843a9e8e328ce50b9723e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe

Filesize
468KB

MD5
4749e3adc1f2ce91492cfc3132b7a017

SHA1
196f03bf0ed7e82abf21a24379e08290d7647534

SHA256
866f46f8337c2f532a19383fa6766f52fd87ab9aac13f4369460b931a488e227

SHA512
3d5d09678d082b73591a852943b91efc03c47f8fdcca1c489f77f1eb1b1422035d29cf65e60d47cf39fd400a8bfc5644ebe39f48c56305ac4c293c8147d1d6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe

Filesize
468KB

MD5
99b0cd365e2cb2bf2cc871f4582341de

SHA1
60c8f9be7ef0de1c3c69ecc2643720fbd8cab6ab

SHA256
4c77b0c108537ac06c63aeb3ecdfed24e65ad6781d223e99b8d4c0ac0b72b8bc

SHA512
4577068cfd61652a44ad60ee6cf04252a76ad6ec9a891bb92bf1afa500d610e288bf655ac387563e0b7a28c63fbe4b824c4c3eb315502329555b830b196888d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe

Filesize
468KB

MD5
77f12fb23ca1ab4b1fff1cfbb0a4770c

SHA1
92c383af4a4bd5363ff3d987d3cf7988ff8e8751

SHA256
35e422d7d499d0f2c8c4e055b52efef668bea788be347b05b08f9a0929214e82

SHA512
548a7ddf9e3b020215fb9b68e7180a3716478a36057b4eb78fec714f273ac43448a00eab46a2c394e324f5f72ae5e1ac8bfa4cba69dedbaa8c8343b0a8d56f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe

Filesize
468KB

MD5
2c77fb8bf9c613a1ea877542b1ebf172

SHA1
82063063889007bcb96c4379855922be8f701242

SHA256
01e097a001d7c47ab05c9f2aace980a73f291ffae13529ad27ba4ab84ad9c35d

SHA512
2c9c0e40a9c9355881d79fcd9f1d7a841d66b0c651407610bc1d2a72620141c3fe4facd4fc83f7d6719086b992d3da3352eb50e8589676b29e6c9fface20ba0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe

Filesize
468KB

MD5
c9cc41f38672f8cf62c9360e03224f9f

SHA1
e1c7afa995cbeeacffd2e32b5aa3187cdf7348c4

SHA256
60874631f39214c7ddf1111d6aec967e3220ce7fec92352f7f11a41ceefeaf79

SHA512
f39bd532641f986f6416b40581c0daa448fc0e9d6cd8a2213394fc139e1802222eb2d67068a254651bc80d145547e8c76d5bf961d81023247e13de07540c00c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe

Filesize
468KB

MD5
9c26587d6f3f57b0d0fe1c343663e0c0

SHA1
0b63dae4d56a7243931a26758b1f181f7d622ec2

SHA256
bd1d546e5123caeb920aa6e3a4100142f7fee97c0726b493d47ce33f3a87a5b4

SHA512
ee52e4761f6acde0ae6d3584d7ac7218096c22015e94913531add13a30cb2306af3a65287505ab09b732b2e1472398d0f0a310ecdb8db3f5a8c448e11266e7b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe

Filesize
468KB

MD5
829bf7423cb9447f19ed298a92689260

SHA1
e48d4a175e857cfb08285b8312124d122f751d7d

SHA256
a98d6bc3b924e091215586cbdd33a1899b19b5e544749c9d43298ccd18e05612

SHA512
92ae38abad136b2de5a13add47c3bbb61893949c2b6cc98c24e112d03070aaa7db1d8bbae2373dcbd55ac468efd5a276543a6b3ed817426996087b28d7270201

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe

Filesize
468KB

MD5
958ae4441a80eb81948500fac483feb8

SHA1
a071294a1579e3890c64d33dec1e27e9495b666e

SHA256
27c3c6d389f48b19fd0eccbc06f0e85efdf7577d5f77a1c56b1b78ae421d88d1

SHA512
c44acb21c686715fcec72c45eb5380103d20db42453a9553369338964d444268ce1cbe45e18eb323c166d5a28d5eeda0304ea1acc15d98e3ba4656e81ae65427

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe

Filesize
468KB

MD5
e53abbfe1a748a5139b917375233ba4b

SHA1
c1cd8e5375299aaa68d6f2d034f46d16e7205719

SHA256
b48579d969efad312fcef45cea08d36346f184b3654e45ebf60ecf24a4d4331f

SHA512
0e6b524414d9df4e01b0309a53ed3e011f429268944a5c5d85702d7b5df7edef1840e4862f323a942d64575d6a240a204465890b35c9a36eed81b0dfc8fa1a51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe

Filesize
468KB

MD5
0dd7766fdf5218adff2f67b96fc86cdb

SHA1
bd93e87efd406fbc3c7ac4acd074b2b7e25c19ab

SHA256
3f84baa5bf059952158f50c1e3532a916d761b20968c57d4edd8b78bcbfc03ab

SHA512
24cde9fe24dbcb5947d53e31a16be9dc31bbf8b1e17380450cfbd827cc37f6eb07187bcfc5feffcbb4c23e52ba7f7999de8b685bcd0cdf8eb54609547d53be59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe

Filesize
468KB

MD5
622d6efd9260a662a45fa55760e059e6

SHA1
eb06b4b8d462eb65903800e8d9fb8662ab508a03

SHA256
058e5d2a7f6268b976c9e337a0a766b7477b3928f655cf5edcb17db9b6cd250e

SHA512
e783ea671d30397d2ef7d60176cacee60e8ce805be475b4a0bec8e51c380652addf2a2a7cb8a9721d4d1d51fea94b408f64cf402056f4f4ea09e99523fea0b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe

Filesize
468KB

MD5
b7c89a96139624cdc196518448dabdc6

SHA1
b83678288242a3be9ae3d4ec025298193c5d4117

SHA256
a083e1ad5f748d4c9fe83caf3a8dca7dd67d56e40adb2ca9ba57ff629760d03d

SHA512
b6c77a5b0ebe282591ff086b9e5d7248973cf32c585d43c9f5b9f1b962f9bc273cfbd10609c22cfb1e25f694b8be5d4f564acb525957a0cdc81c51d52a58e505

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe

Filesize
468KB

MD5
2772101914a669b29ea548b9a02164d5

SHA1
feff487b0af4972d9cbc6e8ace938528e86847c2

SHA256
807460b1978b9b2999fd6c6a756c05083ba27364a633ff98fa26be84b50e015e

SHA512
1138defce2a396037974ca78ca64b3b823bd886536c178d719c9afc8cbf1c9f6999d3047937371b4cd3be99436bcc05db1a6b99a67df48bcc03b7d60bd114136

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exe

Filesize
468KB

MD5
a9144966a8f04f93a314a408468b338f

SHA1
0e07fd0b4fedd8adccfd86266c1c672c9b02c3bd

SHA256
54cf7bd108b54d75fbe7e17728615d0a4fbe6e5b0b28d9a516a387adf734995a

SHA512
76ea75bb595e0bd6866b43e7e6b36588b7b0aad20f70f96ab11165f60ee49a0ebb05e790893b7c207a3eb87ff80b9495707e1926688885475bb148141d66e78d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe

Filesize
468KB

MD5
48a19e4c3e2b6458894380aeb5730e56

SHA1
f2c0b22707c5a8d97a1831dd548f78b60a2550a1

SHA256
d110644fa07f241f3f81ecc496adc402e8ff7fb3796be9580ed03d9eaaa66180

SHA512
e24d53649c18200f75f090ceb8f12412dcaf2e4410c01dd30f320d37503dda61dfa16d75f3691203ac12c1feb82af876a8337f5b845a2ff2f74c7d7ed23f927e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54275.exe

Filesize
468KB

MD5
95882cc62908286e9dba3ad38e0b2433

SHA1
34ced69071b4dfe2ef914d343275112c20f47184

SHA256
70ccfffe25d858c1199cf9bfc58a7f825a135b4c1373278e3f8b40cba495b077

SHA512
ff6a65d6926bf1a7b8428089e9bfd394f09be784ebd958db29d737ad19bf9617d9d631197b236bc77b1ef553bd440c7ad9fc09abf0082f74cba752f5556c59cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe

Filesize
468KB

MD5
c7c78d12964fb468d666eb3304a9765a

SHA1
c721d3a3e128e10e01a9b7f8d4d9cce2b49eb9a0

SHA256
e63a22e4d8f1864b3f603927077c8913b0110b07e6097b0141dc7a1a14180a33

SHA512
c6806d045806b41e4735e28ba3a75f4f7d4368973311c980cc9420aafc45cbfd1937457c558d2af3cc7d1a7019545e3869a445a5076326ff707259e1ac72245c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe

Filesize
468KB

MD5
28df7028e3f80cafa24524395153febd

SHA1
622280bd8f25357f4139eb76f11fa40a7b99613b

SHA256
1b3b345ea568f22d28a86da2cc7cc6d8d2031960f1f784ee14ab78e0a54408a3

SHA512
dd607af7a0ebe5d5bf7f54f94fcd218ee70c91637530c34594256132898cfe0b91b7cc553ea0ef0785f1eed00f2592974c43d294e1d34faefef58b13838f98b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe

Filesize
468KB

MD5
5061613344a6caae66fe29ef09d49e52

SHA1
dc41b9fada6641f5dff22b503032f3c49744ecff

SHA256
ff7d7106e112c039cd7dc3436456fab2d2804e7df3c5a90e560fc23ee8eca1e1

SHA512
db7bacba6eaa9c42da27fc0eaef790f3941621a426b42bd54424d2554f3db97174f9a8ebfc240f6db79c0ecf1abfbbe36b85405c6742fa4412ce61a3fd69001a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57783.exe

Filesize
468KB

MD5
7b15c42c96597a925154a04882543a25

SHA1
72cbf0c3842fe9d6547ceebec6b9f78599e5c7a7

SHA256
74dfe8128f019f862a5965bb817bdf9338ecde38048d3ba4040da57e0dc51b06

SHA512
c27b90171bb191241f742ab3e2bdd076fb2322a2a75ca38a787f26ba891810ca1b258520c8aa09453520354dfbe10ce59021d8375b7149b71e062b66711c4c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe

Filesize
468KB

MD5
1b1c38984276479cd22742ddfa9a1796

SHA1
e94c1c6857efbe58db00cc2010b3bde37df17d3e

SHA256
243fc9a07eb5aab0fec7be2e4790a9b1ef1f2c4dc7aa2a6de9e7e13b33a5c891

SHA512
39a4c248fbb61dfb32202b70408517b4ce7d42c924bca6b2947dd039e49d80f9201e01fb92f493c40a584763c004e26eeec26e1db8e73e592c9cbe237bffc0bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe

Filesize
468KB

MD5
5418d4c87d77276eed3d001ae8f98aff

SHA1
73f0af5f9fbda2021e5bc2c51f64a5bb5e563367

SHA256
22b24a9a19190d33973eb0618421b10477d6c51ce936d804e9f09ea1bd717596

SHA512
7677588c4ab893de4345ebcbfabaa79548f94eb3f33663f84cccc0c90c34618a394360624ff25bdf95e3372aaf9ec89e4cefc851d40cf701f606dee178f579d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe

Filesize
468KB

MD5
4030df66bf4f35d66debe9e04122de1c

SHA1
3661a5315a22f4721121a67a663df228fec3d889

SHA256
8426ab6db145df7e548dc383d4917d5be9949175687d1e864b591534843f1060

SHA512
5aba197c0baff43458cd8f24bc1630cd7ac87c08f5d027caee8ea1fb7d89dddf1e5058d0305890c2de8fd76da0651e4a07aa79d94e99f7be4de7d9c2c07f7010

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe

Filesize
468KB

MD5
4a3def44e50fe53fe923acf39f0627dc

SHA1
f71ef7489bd79bb49edf47bbeb1ca98072b0b4a9

SHA256
56f204a69ebf8b4d53d25dde2f4e8d2d5aa7a0195353bf8c4fc6924c000993f3

SHA512
05099e731523ec43188572fa6a3717600aabcefbd3184f3f28441584343ac05b9698fd3244c816f4b68cd9c9b8e9c220fdc15729bb7ef83eaab78288eaf5406b

Download Submit
memory/60-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/100-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/372-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-3543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/428-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1216-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-4224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3492-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3904-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3964-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4068-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5416-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5552-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5572-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5616-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5800-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5828-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5880-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5932-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5948-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5964-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5984-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6024-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6064-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6796-3496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13548-4052-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13736-4222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13772-4112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13820-4089-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14172-4223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14248-4398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16904-4093-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads