59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe
Size

184KB
MD5

cd67bcf09ad4d6649f970b2de7e42e95
SHA1

472a45c053b52899b5df6a0e9453bc0657268b8e
SHA256

59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f
SHA512

52fbd8028ab13559aec56208b07d3899931781884ab4edd9990674ef0c67f4dc5935a316635065ca596201194ba3ffba19110aca2b6a3276f1e0bbe91d8e7539
SSDEEP

3072:rG5x4konLoQXd4gZUiPn5s/m0lvnqnxiua:rG3o7N4gx5mm0lPqnxiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1272	Unicorn-33943.exe
5108	Unicorn-22843.exe
2524	Unicorn-56262.exe
3764	Unicorn-44379.exe
1896	Unicorn-12261.exe
740	Unicorn-30080.exe
3864	Unicorn-25665.exe
2712	Unicorn-1182.exe
1424	Unicorn-38493.exe
1316	Unicorn-50191.exe
1308	Unicorn-50191.exe
4940	Unicorn-54010.exe
392	Unicorn-48145.exe
2700	Unicorn-53481.exe
900	Unicorn-12540.exe
3980	Unicorn-8919.exe
4732	Unicorn-22563.exe
3120	Unicorn-38991.exe
4172	Unicorn-42983.exe
1100	Unicorn-42983.exe
748	Unicorn-34550.exe
2452	Unicorn-25884.exe
3604	Unicorn-14949.exe
3936	Unicorn-60663.exe
5020	Unicorn-36713.exe
3152	Unicorn-13600.exe
1404	Unicorn-48146.exe
4604	Unicorn-62609.exe
3552	Unicorn-60563.exe
4668	Unicorn-52303.exe
1924	Unicorn-59080.exe
2992	Unicorn-48219.exe
4932	Unicorn-28353.exe
2028	Unicorn-29836.exe
4148	Unicorn-32194.exe
2248	Unicorn-1540.exe
4500	Unicorn-32267.exe
1204	Unicorn-64170.exe
1136	Unicorn-4233.exe
3532	Unicorn-50741.exe
1628	Unicorn-33642.exe
4564	Unicorn-22707.exe
628	Unicorn-36443.exe
3548	Unicorn-32464.exe
1028	Unicorn-16699.exe
2124	Unicorn-15115.exe
5116	Unicorn-43241.exe
2416	Unicorn-19221.exe
2052	Unicorn-11052.exe
2788	Unicorn-58015.exe
932	Unicorn-62754.exe
2176	Unicorn-62754.exe
2884	Unicorn-21707.exe
3136	Unicorn-44265.exe
4212	Unicorn-44265.exe
2288	Unicorn-24399.exe
3560	Unicorn-9454.exe
5000	Unicorn-9454.exe
620	Unicorn-44265.exe
3400	Unicorn-44265.exe
4764	Unicorn-54114.exe
4924	Unicorn-57072.exe
3752	Unicorn-11400.exe
5068	Unicorn-27828.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
9672	5884	WerFault.exe	220
9668	5900	WerFault.exe	219
10700	6468	WerFault.exe	252
10884	6684	WerFault.exe	264
6280	16648	WerFault.exe	862
18112	1916	WerFault.exe	921
1904	6460	WerFault.exe	251
6900	16480	Process not Found	854
13812	18400	Process not Found	1306

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	11204	Process not Found
Token: SeChangeNotifyPrivilege	11204	Process not Found
Token: 33	11204	Process not Found
Token: SeIncBasePriorityPrivilege	11204	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe
1272	Unicorn-33943.exe
5108	Unicorn-22843.exe
2524	Unicorn-56262.exe
3764	Unicorn-44379.exe
1896	Unicorn-12261.exe
740	Unicorn-30080.exe
3864	Unicorn-25665.exe
1424	Unicorn-38493.exe
1316	Unicorn-50191.exe
1308	Unicorn-50191.exe
4940	Unicorn-54010.exe
392	Unicorn-48145.exe
2700	Unicorn-53481.exe
900	Unicorn-12540.exe
3980	Unicorn-8919.exe
4732	Unicorn-22563.exe
3120	Unicorn-38991.exe
2452	Unicorn-25884.exe
4172	Unicorn-42983.exe
1100	Unicorn-42983.exe
748	Unicorn-34550.exe
3604	Unicorn-14949.exe
3936	Unicorn-60663.exe
5020	Unicorn-36713.exe
3152	Unicorn-13600.exe
4604	Unicorn-62609.exe
3552	Unicorn-60563.exe
4668	Unicorn-52303.exe
1924	Unicorn-59080.exe
4932	Unicorn-28353.exe
2992	Unicorn-48219.exe
2028	Unicorn-29836.exe
4148	Unicorn-32194.exe
2248	Unicorn-1540.exe
1204	Unicorn-64170.exe
1628	Unicorn-33642.exe
1136	Unicorn-4233.exe
3532	Unicorn-50741.exe
4500	Unicorn-32267.exe
4564	Unicorn-22707.exe
628	Unicorn-36443.exe
3548	Unicorn-32464.exe
1028	Unicorn-16699.exe
2124	Unicorn-15115.exe
5116	Unicorn-43241.exe
2416	Unicorn-19221.exe
2052	Unicorn-11052.exe
2788	Unicorn-58015.exe
2176	Unicorn-62754.exe
932	Unicorn-62754.exe
4212	Unicorn-44265.exe
5000	Unicorn-9454.exe
2884	Unicorn-21707.exe
2288	Unicorn-24399.exe
620	Unicorn-44265.exe
3136	Unicorn-44265.exe
3400	Unicorn-44265.exe
3560	Unicorn-9454.exe
4764	Unicorn-54114.exe
4924	Unicorn-57072.exe
3752	Unicorn-11400.exe
3268	Unicorn-16860.exe
4260	Unicorn-52988.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1272	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	91
PID 4864 wrote to memory of 1272	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	91
PID 4864 wrote to memory of 1272	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	91
PID 1272 wrote to memory of 5108	1272	Unicorn-33943.exe	94
PID 1272 wrote to memory of 5108	1272	Unicorn-33943.exe	94
PID 1272 wrote to memory of 5108	1272	Unicorn-33943.exe	94
PID 4864 wrote to memory of 2524	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	95
PID 4864 wrote to memory of 2524	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	95
PID 4864 wrote to memory of 2524	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	95
PID 2524 wrote to memory of 3764	2524	Unicorn-56262.exe	97
PID 2524 wrote to memory of 3764	2524	Unicorn-56262.exe	97
PID 2524 wrote to memory of 3764	2524	Unicorn-56262.exe	97
PID 1272 wrote to memory of 1896	1272	Unicorn-33943.exe	98
PID 1272 wrote to memory of 1896	1272	Unicorn-33943.exe	98
PID 1272 wrote to memory of 1896	1272	Unicorn-33943.exe	98
PID 4864 wrote to memory of 740	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	99
PID 4864 wrote to memory of 740	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	99
PID 4864 wrote to memory of 740	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	99
PID 5108 wrote to memory of 3864	5108	Unicorn-22843.exe	102
PID 5108 wrote to memory of 3864	5108	Unicorn-22843.exe	102
PID 5108 wrote to memory of 3864	5108	Unicorn-22843.exe	102
PID 3764 wrote to memory of 2712	3764	Unicorn-44379.exe	103
PID 3764 wrote to memory of 2712	3764	Unicorn-44379.exe	103
PID 3764 wrote to memory of 2712	3764	Unicorn-44379.exe	103
PID 2524 wrote to memory of 1424	2524	Unicorn-56262.exe	104
PID 2524 wrote to memory of 1424	2524	Unicorn-56262.exe	104
PID 2524 wrote to memory of 1424	2524	Unicorn-56262.exe	104
PID 1896 wrote to memory of 1316	1896	Unicorn-12261.exe	106
PID 1896 wrote to memory of 1316	1896	Unicorn-12261.exe	106
PID 1896 wrote to memory of 1316	1896	Unicorn-12261.exe	106
PID 740 wrote to memory of 1308	740	Unicorn-30080.exe	105
PID 740 wrote to memory of 1308	740	Unicorn-30080.exe	105
PID 740 wrote to memory of 1308	740	Unicorn-30080.exe	105
PID 4864 wrote to memory of 4940	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	107
PID 4864 wrote to memory of 4940	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	107
PID 4864 wrote to memory of 4940	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	107
PID 1272 wrote to memory of 392	1272	Unicorn-33943.exe	108
PID 1272 wrote to memory of 392	1272	Unicorn-33943.exe	108
PID 1272 wrote to memory of 392	1272	Unicorn-33943.exe	108
PID 3864 wrote to memory of 2700	3864	Unicorn-25665.exe	109
PID 3864 wrote to memory of 2700	3864	Unicorn-25665.exe	109
PID 3864 wrote to memory of 2700	3864	Unicorn-25665.exe	109
PID 5108 wrote to memory of 900	5108	Unicorn-22843.exe	110
PID 5108 wrote to memory of 900	5108	Unicorn-22843.exe	110
PID 5108 wrote to memory of 900	5108	Unicorn-22843.exe	110
PID 3764 wrote to memory of 3980	3764	Unicorn-44379.exe	111
PID 3764 wrote to memory of 3980	3764	Unicorn-44379.exe	111
PID 3764 wrote to memory of 3980	3764	Unicorn-44379.exe	111
PID 1424 wrote to memory of 4732	1424	Unicorn-38493.exe	112
PID 1424 wrote to memory of 4732	1424	Unicorn-38493.exe	112
PID 1424 wrote to memory of 4732	1424	Unicorn-38493.exe	112
PID 2524 wrote to memory of 3120	2524	Unicorn-56262.exe	113
PID 2524 wrote to memory of 3120	2524	Unicorn-56262.exe	113
PID 2524 wrote to memory of 3120	2524	Unicorn-56262.exe	113
PID 1308 wrote to memory of 4172	1308	Unicorn-50191.exe	115
PID 1308 wrote to memory of 4172	1308	Unicorn-50191.exe	115
PID 1308 wrote to memory of 4172	1308	Unicorn-50191.exe	115
PID 1316 wrote to memory of 1100	1316	Unicorn-50191.exe	114
PID 1316 wrote to memory of 1100	1316	Unicorn-50191.exe	114
PID 1316 wrote to memory of 1100	1316	Unicorn-50191.exe	114
PID 1272 wrote to memory of 748	1272	Unicorn-33943.exe	116
PID 1272 wrote to memory of 748	1272	Unicorn-33943.exe	116
PID 1272 wrote to memory of 748	1272	Unicorn-33943.exe	116
PID 4864 wrote to memory of 2452	4864	59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe	117

C:\Users\Admin\AppData\Local\Temp\59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe
"C:\Users\Admin\AppData\Local\Temp\59661c9ad56ec1e9ecd3d6a15ff45184dd8f079672af3db94e125fcccb91cf1f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22475.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        9⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 632
        10⤵
        Program crash
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        9⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        9⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        9⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33700.exe
        9⤵
        
        PID:17584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        9⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        9⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        9⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        9⤵
        
        PID:18272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
        8⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        9⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        9⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        9⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        9⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        8⤵
        
        PID:18272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        8⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        7⤵
        
        PID:17520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        9⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        9⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
        9⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        8⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        8⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45905.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        8⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8222.exe
        8⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        8⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        8⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        8⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        8⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        7⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        7⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64737.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9371.exe
        7⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54437.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        6⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        6⤵
        
        PID:17996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7050.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        8⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        8⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38282.exe
        8⤵
        
        PID:17560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        7⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        8⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        8⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        8⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14324.exe
        8⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        7⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
        7⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        7⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38397.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14692.exe
        6⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3546.exe
        6⤵
        
        PID:18228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52929.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64411.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60719.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        6⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        7⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        6⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31261.exe
        6⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        5⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57669.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        9⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        9⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
        9⤵
        
        PID:16984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        9⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        8⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54924.exe
        8⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        8⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20211.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50404.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        8⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        7⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29443.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40455.exe
        8⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        8⤵
        
        PID:18404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
        7⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
        6⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20073.exe
        7⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24399.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35525.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        7⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
        7⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9066.exe
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        7⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        6⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        6⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
        5⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
        5⤵
        
        PID:17540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
      4⤵
      Executes dropped EXE
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35795.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63615.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
        7⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17165.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7652.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40238.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        5⤵
        
        PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        5⤵
        
        PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
      4⤵
      PID:15240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53051.exe
        9⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8951.exe
        9⤵
        
        PID:18156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        9⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        8⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        8⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        7⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        8⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        8⤵
        
        PID:17372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        7⤵
        
        PID:17532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36093.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        6⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49771.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12378.exe
        8⤵
        
        PID:18256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 464
        8⤵
        Program crash
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19827.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36948.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        5⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49771.exe
        7⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31954.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        7⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        6⤵
        
        PID:18296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        5⤵
        
        PID:17480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29836.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
        7⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        7⤵
        
        PID:18400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        6⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47918.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52189.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39801.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        6⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        6⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        5⤵
        
        PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
      4⤵
      PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe
        5⤵
        
        PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        5⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        5⤵
        
        PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      4⤵
      PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
      4⤵
      PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
      4⤵
      PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        7⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        7⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        6⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        6⤵
        
        PID:16592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        5⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        5⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
        5⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        5⤵
        
        PID:17664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50851.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exe
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        5⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        5⤵
        
        PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      4⤵
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
      4⤵
      PID:12516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
      4⤵
      PID:15740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
      4⤵
      PID:17984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42958.exe
      4⤵
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        7⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40238.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        6⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        5⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        5⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        5⤵
        
        PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48919.exe
        6⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        5⤵
        
        PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
      4⤵
      PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
      4⤵
      PID:3668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
      4⤵
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        5⤵
        
        PID:16480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        5⤵
        
        PID:17760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10631.exe
        5⤵
        
        PID:17944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
      4⤵
      PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
      4⤵
      PID:13180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
      4⤵
      PID:16288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
      4⤵
      PID:18376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
    3⤵
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        5⤵
        
        PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
      4⤵
      PID:13196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
      4⤵
      PID:16312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57411.exe
    3⤵
    PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
      4⤵
      PID:12188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
      4⤵
      PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39129.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
      4⤵
      PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20032.exe
    3⤵
    PID:8508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
    3⤵
    PID:11808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
    3⤵
    PID:14684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
    3⤵
    PID:17456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
      4⤵
      Executes dropped EXE
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26699.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        9⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        9⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        9⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        9⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        8⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32148.exe
        8⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12094.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        7⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        7⤵
        
        PID:18228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57238.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        7⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        7⤵
        
        PID:18344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15909.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        7⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61967.exe
        7⤵
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        6⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14503.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        5⤵
        
        PID:17500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19497.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
        6⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28073.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38282.exe
        6⤵
        
        PID:17640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8830.exe
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55797.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18219.exe
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29766.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        6⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        6⤵
        
        PID:16904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        5⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38135.exe
        5⤵
        
        PID:17660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        5⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        5⤵
        
        PID:18316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
      4⤵
      PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
      4⤵
      PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe
      4⤵
      PID:10036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31954.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        7⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        7⤵
        
        PID:18428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        7⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        7⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        7⤵
        
        PID:18256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        6⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        6⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30646.exe
        6⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        5⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59757.exe
        5⤵
        
        PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        7⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        7⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25550.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35760.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10367.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        6⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        5⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        5⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        5⤵
        
        PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
      4⤵
      Executes dropped EXE
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        7⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        5⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
        5⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        5⤵
        
        PID:18332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
      4⤵
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        5⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9576.exe
        5⤵
        
        PID:17632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      4⤵
      PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64941.exe
      4⤵
      PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      4⤵
      PID:17400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
      4⤵
      PID:17704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        7⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
        6⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57238.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38815.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        6⤵
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14406.exe
        6⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55797.exe
        5⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        6⤵
        
        PID:12928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32583.exe
        6⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20354.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39801.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5976.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
        5⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        5⤵
        
        PID:18420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        5⤵
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
      4⤵
      PID:9588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50847.exe
      4⤵
      PID:16088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19543.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        5⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        5⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
      4⤵
      PID:5884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 720
        5⤵
        Program crash
        
        PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
      4⤵
      PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
      4⤵
      PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      4⤵
      PID:14992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
      4⤵
      PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
      4⤵
      PID:17972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
      4⤵
      PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57699.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60694.exe
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26676.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
      4⤵
      PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
      4⤵
      PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40393.exe
      4⤵
      PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
    3⤵
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
    3⤵
    PID:11336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
    3⤵
    PID:14976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
    3⤵
    PID:5744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46356.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
        8⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4788.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        8⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        7⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31476.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37612.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
        6⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        6⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 604
        7⤵
        Program crash
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
        5⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        5⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52513.exe
        5⤵
        
        PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        5⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        6⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        7⤵
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
        6⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        6⤵
        
        PID:18172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        6⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18535.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
      4⤵
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17981.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        6⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        6⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31082.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        5⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
        5⤵
        
        PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
      4⤵
      PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59247.exe
        5⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
      4⤵
      PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
      4⤵
      PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12700.exe
      4⤵
      PID:17544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16633.exe
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
      4⤵
      PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50741.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46356.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        7⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22364.exe
        7⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        6⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        5⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        6⤵
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        6⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        5⤵
        
        PID:18280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exe
        5⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13517.exe
      4⤵
      PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47813.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46483.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
      4⤵
      PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
      4⤵
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-274.exe
        5⤵
        
        PID:6468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 632
        6⤵
        Program crash
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        5⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        5⤵
        
        PID:17472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        5⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34294.exe
      4⤵
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
      4⤵
      PID:17420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
    3⤵
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31385.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1696.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        5⤵
        
        PID:18420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
      4⤵
      PID:15796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
    3⤵
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
      4⤵
      PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
    3⤵
    PID:10116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
    3⤵
    PID:14376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
    3⤵
    PID:17700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
        7⤵
        
        PID:16648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16648 -s 472
        8⤵
        Program crash
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        7⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        6⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        5⤵
        
        PID:18204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
      4⤵
      PID:5900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 632
        5⤵
        Program crash
        
        PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
      4⤵
      PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
      4⤵
      PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
      4⤵
      PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
      4⤵
      PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
      4⤵
      PID:17888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
    3⤵
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4773.exe
        5⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        5⤵
        
        PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      4⤵
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
      4⤵
      PID:13772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
      4⤵
      PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
      4⤵
      PID:17920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
    3⤵
    PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22039.exe
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
      4⤵
      PID:13268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
      4⤵
      PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
      4⤵
      PID:18328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
    3⤵
    PID:8148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
    3⤵
    PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
    3⤵
    PID:13624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
    3⤵
    PID:3828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25884.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25884.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
      4⤵
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57031.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
        6⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47166.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        5⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        5⤵
        
        PID:17512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
      4⤵
      PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        5⤵
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        5⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
      4⤵
      PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
      4⤵
      PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
    3⤵
    PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        5⤵
        
        PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
      4⤵
      PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
      4⤵
      PID:11740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
      4⤵
      PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
      4⤵
      PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63573.exe
    3⤵
    PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
      4⤵
      PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
      4⤵
      PID:7268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
    3⤵
    PID:8732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
    3⤵
    PID:12032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46483.exe
    3⤵
    PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
    3⤵
    PID:7160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
    3⤵
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        6⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        5⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17741.exe
      4⤵
      PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        5⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exe
        5⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        5⤵
        
        PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
      4⤵
      PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54280.exe
      4⤵
      PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
    3⤵
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
      4⤵
      PID:14936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36362.exe
      4⤵
      PID:16832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
      4⤵
      PID:16896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
    3⤵
    PID:12616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
    3⤵
    PID:15936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
    3⤵
    PID:18004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
    3⤵
    PID:6992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
  2⤵
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
    3⤵
    PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
      4⤵
      PID:12944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35795.exe
      4⤵
      PID:13600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
      4⤵
      PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9869.exe
    3⤵
    PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
    3⤵
    PID:12980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
    3⤵
    PID:16116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
    3⤵
    PID:18264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
    3⤵
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
  2⤵
  PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
    3⤵
    PID:11380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
    3⤵
    PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56345.exe
    3⤵
    PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
    3⤵
    PID:16648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
  2⤵
  PID:8392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
  2⤵
  PID:11668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47342.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47342.exe
  2⤵
  PID:13336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
  2⤵
  PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5884 -ip 5884
1⤵
PID:9420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5900 -ip 5900
1⤵
PID:9596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 6468 -ip 6468
1⤵
PID:10420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6684 -ip 6684
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1916 -ip 1916
1⤵
PID:18144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:7152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe

Filesize
184KB

MD5
9f09ee59e24a8df0d7fe5e49e0efa1e4

SHA1
fe04917bdabcef69d647802ca0603fee678b52e8

SHA256
c5d27a68f7fbe07e85bc1f2c519024c47d0ad9c851e7d5484bebae2097649173

SHA512
829f75d3d78448ba23097a62a0c623cdb92aa20e992e6dcedee1fba683404da271e81242d118bf93a6104ac9cc09de1f3f3b7f52d455211f2517bcdb40570b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe

Filesize
184KB

MD5
6e895f0c7186d8b87fd83bc9b79d83de

SHA1
a624ceaa7c9fb8e4339cb3a03ee8acc75fc71763

SHA256
d46e04c8ee604b690015b8690710f9ef3d9b150d1061a2ea6c874a238da6d682

SHA512
cb769271d5c71849a0f7fcf7554656e89e148e2d249828bc8df9b76c71e66bb130ef2a9052a56844cf0e960af6a087bb40a1ac8b5af18dbbb87d48d29d016690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe

Filesize
184KB

MD5
68a5235afbe8b69d3a988c7a0996beb8

SHA1
ddb8714c59d2e5cbd0188b7a449479c7cfac92ef

SHA256
699e559ea3ab9ffe107a9d4e25fd1d84a3197e02e1b64cac82b2bf39434c79b9

SHA512
2141dfd026c7f70c0d5f81ca40736d5043581bc4999739242a53f52f33d5336c04676cd3a1d2461aaaf1b955c825a3ca758b91fa755a0dc93f199241471fb454

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe

Filesize
184KB

MD5
57b788c7bd3664ea37c4e11156456c03

SHA1
913a819afb59a48ef75f1331e301b0a3f764b0d0

SHA256
4bae2f854eb38d7bb44f85040ddbbdba261e57756a7918f273c723358f35cd98

SHA512
a486507864bfde435213112154ca54740ab18b46c3f40c7d7fc26c3128122b24d5a6f471b2d8dfd8b7cf1078319bff7630f39f3b32a91f4dcad3fdcc44c1720e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe

Filesize
184KB

MD5
33680e333ebff45000dee00a8c9e2075

SHA1
5912274c18466ac5934019dab883ec07f751d63b

SHA256
4f5732d3974281009132eaa8f1d3ca82948c8cb0cadeb3691651df9fd2cd1fb5

SHA512
591b28ca79296aa71201813c1305d33ee9c7f13a97f27c2c47d2361bc2e347946353fb4088cacff7c435d2ab88f3d26310e73128e0316fdef80fac7266c50571

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe

Filesize
184KB

MD5
2511fc13e01868277aae2427f59fa83e

SHA1
b83634956b19e4305d4fa9c7a724041fcc05b4f7

SHA256
2a49cdc1ff1665a4cb84203379bce2a5a748388bcb43a2f21bf11c27ebebd46e

SHA512
2da709af2b48d1613e8bffe1ad4c8e927de6c3608f131753dc4646b4acdf319e3547f561e8438abc4d820cef266fa90ea151b14503b2ca7eacfdbdd04f5e5dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe

Filesize
184KB

MD5
b383d9c93d5e90c552d9348a50e6b8fb

SHA1
2cc4efc988c462f74f79b5596205d480a3e2956e

SHA256
87a6e310de693aaee1e57da61f42110f08d5d78bfa73ac838bd72af518de8fd7

SHA512
29b2e7bb69d62c7de0e89004a9bf3cdfa32bef3de197e25001fba66380527a111820b9f5c02fd08bc89d9efbf54df51d9507a5b90fda43e7f71c38f9b7a9061b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22563.exe

Filesize
184KB

MD5
cd7e2907966aababb2d836777133d38f

SHA1
4ff9d8980d4bac8ffadfe7bbc4939515cab11bbe

SHA256
dd4bc39b042ed7ad3f24bbc047c69f8e8bc262f9392f44d2e2daa9525623bec0

SHA512
4829295320b12325dfe9d6a11abf615bc0b3f2219497d0c0ea1e9c5dcfe666afc71dfb92980e8d6fd6ac56a03208db03889474ab9517c09da3d71f7213a8348a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe

Filesize
184KB

MD5
4d3c947d48b6fdcaec602dd6a8fa873a

SHA1
742d5b5377f6e9d1788a544a1309c4efd74a769e

SHA256
4a38f30dbc6ec0d4bd7d950014d2a5ae362ea4a6010047d1cb3b51f3430f3880

SHA512
c48cb1b4da7b2c9b460b924c0081b4acb3d138e51bac3a537021c04c3ea43d86787298b0113bddc48d91b6ebe028610e410493ce44813d2585de498c1aa97371

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe

Filesize
184KB

MD5
bac2aaebfd1faf884cbcdd75dc8320fa

SHA1
f9ce3695c78eac7d744349f793e1210963e1e380

SHA256
2bf2ceb69897c8a8b1c8b776713841762b0bc3db2f524b5b4522e9a90156e91f

SHA512
a25b3648ee4db5500b665c324f6e27d6e0bfd55400a45416477b26a4caaa725d65a397d4148da8ce5055e9818d860f5d2936c4b1112e56393e2d40ba202f01ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe

Filesize
184KB

MD5
02ba826e5cec29f79f1e72ef1b763898

SHA1
eaa377783d76c0e2cd4e075c548fad93df0c61c7

SHA256
730990c73750c18dc3bfd26f10c2f7831b879f6792edbeb149db93831e57e6a2

SHA512
87ca1fcf1de9fdfa62dbb57cca490253cf7edc2bc535645b6c0a6ba82db784882b72ca6e1300e69de97c165ff9b4ee58078e50e00a2a35d3abbc1c88997e5b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25884.exe

Filesize
184KB

MD5
35682a587e1326a98089c9a95829453e

SHA1
00b192d95a9404a75758d53a8d73d7675859d4ef

SHA256
d2ef7dc6f69b07cc5e2d62c380df70320803099bf8be7723fe4df8fdc45184d9

SHA512
3b799dfddedb134be7efa60f8a690e3a59c6ff722c254ce0473b82de027810fe14d808cfb672e51b38dab64ffafb1a87817c750d9d8621ab98b086a3e22870ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe

Filesize
184KB

MD5
48af0fe18a1f07d3913715dd88502318

SHA1
d36af6aa8c3a4b195680ee31272ad2e430a337b2

SHA256
9ce5b3c6a46a2fdfcf3f893596698988429ad9ff89c51c2ceefcdc6afa19524a

SHA512
1a20b32f78f682f4db24ebf7cc5e55f13277728ed3daa81ff968abae654877188a00b81ff0cb436924bbfd0a7bbc7f8566089dcadce369793065da4588800997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe

Filesize
184KB

MD5
9982883f8c79f863fc0b5495e0417342

SHA1
d970d624cd410e8071bfec142c1a189a8b079c10

SHA256
ba06fd4ee70c854e52662c199c439aaa233ecd83d93509cc7990abe3b7e10cbb

SHA512
e7e458a1929a7fbef4c90c0a5b6a11fb174d5f72ce6fa12d8e5a6bf898639b68dd1bd72b86b75fd1079ea5901688afb5a4d99f1ea422dbdc5e069d7b9621bcc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe

Filesize
184KB

MD5
8f05efcee76764637741c179e8ef6e67

SHA1
fb4375d9d601c819992187692b87648cbff9b28e

SHA256
a90723f2acd2b5e63a3be70d71fa0fc476d7e6fb7610e20816fba1c660600199

SHA512
9ef8531b63991dd3ad344ebbf2249b6eff603a681717052154b3fd6a88717355e77b6bf91681bea799596d8b8a9614273b756e1d00e5fd925607e0edc859db5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe

Filesize
184KB

MD5
83f3aef23a01dbde535288760ee0cd79

SHA1
072d8bdeadce7d6bc65fe6ddea7823e92ef07b43

SHA256
2f4eb148e998b75861daec93a9e687b0037fe93afc19f066460104fe70faf55c

SHA512
b0c719abe6554b729907667e6c292c1798b0953af25450683b4f5d1e67aa1157c7019e2370eb61f9f804b16ed0d12f7f226e368d8ca9af27e17d8812a494f48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe

Filesize
184KB

MD5
96b7ecb09a446351a923c431d02f0ae7

SHA1
4b76608abf34c543f7375732fb19b4d9b6170251

SHA256
7e347b6c871d9bffcc9850d79121994891204db8912b53a3cbf9b0d58882f685

SHA512
0bd98f4bd546c1450c85a5f2740acf60e960a0fc7de09ebbd4d990b5f0bd38c3f430d674c60ad58f77a512103373767df63145b13e4ca060c677b1335a7fdd68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe

Filesize
184KB

MD5
512b3feb2b20d53c413f72a6f6270a6c

SHA1
adcbaee9110702ff589d0aa0c5b1009e9d2c9b63

SHA256
1dc88c115acc7e69f61c0e82529b1cd9aa8840172a5c61f0e4cd54fff4345d21

SHA512
635235866dadade2dc3d156dd1cc777fb4b97313d4077bfd526af4a3ffb72359839d157667f595a99ef77035d839db0848dee255f1581ca2374f3ad24174a792

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe

Filesize
184KB

MD5
7a3876f5db39dc774065a23608e99132

SHA1
bb047000bbaa83d4f7217a0734622cb41ba8d240

SHA256
29e08d1e84b2baadb6faaeb7813c20a42881ea04364e0bcdfbb3773b2f17db73

SHA512
e2554daa1794e9b7f050207316e80753683718e9c8ffb2e32f31c527bdfe27918af1f143bfe139a4606101d12b6cae3d56376d7e197f2a09511e863dc683993b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe

Filesize
184KB

MD5
8bd8a072612a4ce25542eebca37f34b9

SHA1
c68ef5191fa350515f7102a7b107c054405448ca

SHA256
e3df3c81192b0d682ab1b01c1129293fa127515db9f4b7611fa86001f921684c

SHA512
9b002ddb506e3de3abedac8aff655b0b3c0f886a6270058d085be0dd02585fdba2250636f6a236d17da3f5825c00ada320cabaf32cff33f914c4d369c0e6c5f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe

Filesize
184KB

MD5
de57902bd90c2d4c9c0b398b49e3c901

SHA1
7848dab954e1ad573dbc807248f55b485bfc2977

SHA256
ca73a34b578f8f67760162403357fcf95854a5f206af9e90fbe7702d23296992

SHA512
d9e499d0dd250e737969eb36643fa9ba7eea85df9c3cb69e5a6d9bd3e08748c8cfcff7b2531ed0393d88ac05401f14974e83dcc1c85704cd3fd602197f0ad644

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe

Filesize
184KB

MD5
b56fae6bf891e88430e9c808d8b49df4

SHA1
1c98fc36db93e2b4dc0a1008b02ca9e038d31a18

SHA256
62f76de169e7bcb1f4e4e1a241fdc19eeff9ec8b9433d56fa2261ad8ba134284

SHA512
cb33e93169caf94ce415b19358b8bbae83dbcab827655e43cfcf31320e77e024848f07200645998d41b373adab1dc2355e1ba4a87b626081e783dd7c1b20d8d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe

Filesize
184KB

MD5
5b0c46d2eb51b72e764eca45ae2caa43

SHA1
11284c41981921dbc568d0160a787c8f73d98660

SHA256
7961714ebae0dbd7063acf5447b2e12617ee486b8a0dac96967afd47a3ef8674

SHA512
e20000ff63e85d751dab0f2539dc3fde1a906a08de0c7bf2c5d707e2641d546fd2fa8b128a30025377db61ca6a399b23ce6b3b5e99612d9de65fee6a2e02fa2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe

Filesize
184KB

MD5
bfab7ec4cf5f834fafbc6f1361178e98

SHA1
3083727800c24501f31043db928aea03d880e56d

SHA256
48fabdd945939af042b4627e83e0490f5f3f7a1e46d1c8d9c44def78318d1242

SHA512
901ceaee289849263820627446b96ebf7f887d13e0da3e0019860e74d679262bf30fc08a431516ab3ebfceb3b9c719d13914b4473cf7d078e3e7eafac79a9113

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe

Filesize
184KB

MD5
6106bc681fef8d1fd7038f60ee33eacf

SHA1
bde115da96b2ab2c30ed37f11cfa48b316bcffac

SHA256
527530339610af6d50b607989d03e2a3d7aee014b3063d51b7dbaeae28f1d8b2

SHA512
9870fb2d94b4f54a6fbb55ee9174def8865a696640f638f34fddc63febb1095464fc5564718fa06467ac95277c96704e23b06fd823c376b7a684939f540e7f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe

Filesize
184KB

MD5
b272b21d5baf50972cdcfc3cda09259f

SHA1
2a42466f42b28278bf4b7e64e7f781faac46fbfa

SHA256
51030ae6dedf6305b7550eaf80427a7a8f13ae8b03094b4bd4210819c3cd87cc

SHA512
22cc82299d9ba88e74762813bd7969f5f969d7d49d5ca01da14dc0852f500109385dd7126de96ecb742ed3fe32965b7e251714112de1cec6b7cd92b0ea721db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe

Filesize
184KB

MD5
b04918ff72071faacf31a09e27c18b90

SHA1
d20928c3693295596a8f649daeff3145256c4735

SHA256
fa1066a379dd2d6b666d49abba97f9643d5138186d0276ac14ed182a1d023c7c

SHA512
0449a78206a55c5c298df77ee35763374e64de02ba271985db21d39360a566f5451899ea515fffdf83e13d77d01f9dac27307ae54d6c5631281cf00667969af8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe

Filesize
184KB

MD5
35e43bf9ef4db76c0a12ed291af8b54b

SHA1
b851ea733c4980c18a84e965c84d9a18086804a0

SHA256
8d748a795beb83c3acd96c8137bfd731b992ef58d079d8f91d526973a79f189d

SHA512
cb03e12dbc3602067e75e11cc426ff27de8e3f29dbc51dd2a3df9c3bc0e51ffc7ddd7f65401d2a440e6ea0262b9efc0579ef1e10519710fb9bf6873acdfccbbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe

Filesize
184KB

MD5
1ae65df5abaebfa482ea333cb77cc472

SHA1
0af32a61a222d34c469ef11d43703400117f2471

SHA256
d1a2cce3371fea81f22979e5f4608eadd5f26c34c0e7ffc3c4bd0abcadab6c30

SHA512
701fa83e01887b13a9534750edcfd76c74f72203477ed29ae670f7badc96cb8d5a21d4c15d4008518799eae142a35e18887545e6a6aca67e93359fb73d6c3250

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe

Filesize
184KB

MD5
b7c4a4a5b6d1a93852596f964ed6ce66

SHA1
174376a552346a52c805c601feb9736de32f5adf

SHA256
e2d6629509f2fe5be45abf0d7c905d31bef051bbaf79d17c9908c784e40adbcd

SHA512
305e9d7e7e5df5e5d19c92a2860ff7233c345706faa88ffd9c87a216d22e1aa6962f759098cca5e0fb61af6bb9d6dcba7978ac64bf3b5e0c322ccde4e2f87f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe

Filesize
184KB

MD5
552e6a578d2117d41c6dfc1cdcd9f5dd

SHA1
6f8ef774be5db8b3a76222511282bcb51eb45555

SHA256
075d2693544d74bf8ac4bc9b0570974f78231cf8d5c2a557d2911f748160e55f

SHA512
17296fb1d648820cc57f77439a4c9b811f780b04036d6f86ace31acd7a8cfd6ac2ccd0a8ec1457295ada968b984e8fe225ea7f67df8897d3ee5e485e64344aff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe

Filesize
184KB

MD5
82b1937aeab9c5d24acc3fec570868ee

SHA1
e2e35ccde4c286661f7281e797e640fe2c82195f

SHA256
d08b920ced7c827df14e9e7af6bc7564fafac913fd8904b18f24fffe54b6656b

SHA512
ad1697b885dea2fe4186db22619b8fc2fd8c31217cf2837e1328173a7894fb98cead1aa0a9026e98ff20be2f771e5c40a57e17bc086c87dc31e0a683d1a6acbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe

Filesize
184KB

MD5
ef9ed4225fded04cfdc40c041fdea88f

SHA1
9eedda01c5357a9157d96b17836d99f57acbd6ba

SHA256
ef7107992c26ae242bae30368022597909a8747fb5481be85f0c3e4fcd33257a

SHA512
32a88de1e3e8e58712522d42b9ae338c3924ebd198e084ca5caa6bfec65db8d2c9115f3c761ff7a9f7b4cd02859a2410fe35df06591b9b37ca62ef2d8c7cb85c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe

Filesize
184KB

MD5
91dd453a6fd35f409f574c9f9fee8b05

SHA1
33f8c44b2ce55002ec464bc07330a3ecda2d4ed0

SHA256
eb0e9bf626d8412a4d66cc3cd13e0366b702662612ac018c95491f7b6b24cfc7

SHA512
a9d4e9747291c579cc00f9319f28c7348a603c20d9bf54250e471e9f410676d07a2dc4e78a8bbcd000f9fd9dfb389c88f245aca15038829a0059144ffd831cd6

Download Submit
memory/392-3941-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

Filesize
2.0MB

Download
memory/6904-3895-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16896-3565-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads