6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe
Size 184KB
Sample240602-2ml86ahg2x
SHA256 6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c
MD5 2896b6f11464b4e1be8d283d44ee0bc9
SHA1 379b721c3212b34b2dfa1e04e7a07b2b700fa5b0
SHA512 c55e1acb87049f82b080a40c4a55c4349a23f18935b9f76294b65777babbd53ea41f5cd897b7869b101404e9348b8185ab0dc76c7f2f9b92a45009d13cdccbd2
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWclDvnqnviuA:rzEoDjww7zsW0DPqnviu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1360	Unicorn-52019.exe
3284	Unicorn-24355.exe
2520	Unicorn-31131.exe
2340	Unicorn-810.exe
4324	Unicorn-38313.exe
3236	Unicorn-54095.exe
4772	Unicorn-13154.exe
2452	Unicorn-42995.exe
4960	Unicorn-15537.exe
4724	Unicorn-49793.exe
4168	Unicorn-39579.exe
632	Unicorn-33000.exe
2500	Unicorn-2538.exe
3756	Unicorn-9315.exe
2924	Unicorn-50945.exe
2024	Unicorn-57722.exe
2480	Unicorn-49362.exe
4788	Unicorn-65143.exe
2496	Unicorn-46761.exe
5068	Unicorn-7774.exe
4780	Unicorn-49170.exe
372	Unicorn-60867.exe
4600	Unicorn-30141.exe
4972	Unicorn-24010.exe
3476	Unicorn-56783.exe
5028	Unicorn-21973.exe
4008	Unicorn-63560.exe
3892	Unicorn-17623.exe
1052	Unicorn-13042.exe
4756	Unicorn-45875.exe
2300	Unicorn-52460.exe
916	Unicorn-55989.exe
628	Unicorn-51905.exe
1380	Unicorn-6880.exe
4392	Unicorn-6880.exe
2180	Unicorn-566.exe
3132	Unicorn-42153.exe
3404	Unicorn-57935.exe
2912	Unicorn-21719.exe
4552	Unicorn-21453.exe
3488	Unicorn-7883.exe
1060	Unicorn-35917.exe
4728	Unicorn-35917.exe
3536	Unicorn-38417.exe
4720	Unicorn-19389.exe
4152	Unicorn-13258.exe
2236	Unicorn-11220.exe
64	Unicorn-7136.exe
4888	Unicorn-3052.exe
2144	Unicorn-35531.exe
2700	Unicorn-50783.exe
3628	Unicorn-6321.exe
3924	Unicorn-2237.exe
4216	Unicorn-37863.exe
4328	Unicorn-41131.exe
392	Unicorn-60732.exe
3592	Unicorn-47983.exe
3328	Unicorn-44853.exe
1216	Unicorn-40769.exe
464	Unicorn-61281.exe
60	Unicorn-47546.exe
4280	Unicorn-61765.exe
2532	Unicorn-57681.exe
4028	Unicorn-3005.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
8	4152	WerFault.exe	136
5904	64	WerFault.exe	138
5356	2180	WerFault.exe	126
6604	460	WerFault.exe	163
8068	5884	WerFault.exe	232
18956	17168	WerFault.exe	832
19012	15896	WerFault.exe	798
14144	19260	Process not Found

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5200	dwm.exe
Token: SeChangeNotifyPrivilege	5200	dwm.exe
Token: 33	5200	dwm.exe
Token: SeIncBasePriorityPrivilege	5200	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe
1360	Unicorn-52019.exe
3284	Unicorn-24355.exe
2520	Unicorn-31131.exe
2340	Unicorn-810.exe
4324	Unicorn-38313.exe
3236	Unicorn-54095.exe
4772	Unicorn-13154.exe
2452	Unicorn-42995.exe
4960	Unicorn-15537.exe
4724	Unicorn-49793.exe
632	Unicorn-33000.exe
3756	Unicorn-9315.exe
4168	Unicorn-39579.exe
2500	Unicorn-2538.exe
2924	Unicorn-50945.exe
2024	Unicorn-57722.exe
2480	Unicorn-49362.exe
4788	Unicorn-65143.exe
2496	Unicorn-46761.exe
5068	Unicorn-7774.exe
4780	Unicorn-49170.exe
372	Unicorn-60867.exe
1052	Unicorn-13042.exe
4600	Unicorn-30141.exe
4972	Unicorn-24010.exe
5028	Unicorn-21973.exe
3476	Unicorn-56783.exe
4008	Unicorn-63560.exe
3892	Unicorn-17623.exe
4756	Unicorn-45875.exe
2300	Unicorn-52460.exe
916	Unicorn-55989.exe
628	Unicorn-51905.exe
4392	Unicorn-6880.exe
1380	Unicorn-6880.exe
2180	Unicorn-566.exe
3404	Unicorn-57935.exe
3132	Unicorn-42153.exe
2912	Unicorn-21719.exe
4552	Unicorn-21453.exe
3488	Unicorn-7883.exe
4728	Unicorn-35917.exe
1060	Unicorn-35917.exe
3536	Unicorn-38417.exe
4720	Unicorn-19389.exe
4152	Unicorn-13258.exe
2236	Unicorn-11220.exe
64	Unicorn-7136.exe
4216	Unicorn-37863.exe
2144	Unicorn-35531.exe
3628	Unicorn-6321.exe
3592	Unicorn-47983.exe
3924	Unicorn-2237.exe
4888	Unicorn-3052.exe
392	Unicorn-60732.exe
2700	Unicorn-50783.exe
4328	Unicorn-41131.exe
3328	Unicorn-44853.exe
1216	Unicorn-40769.exe
60	Unicorn-47546.exe
464	Unicorn-61281.exe
2532	Unicorn-57681.exe
4028	Unicorn-3005.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1360	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	84
PID 4532 wrote to memory of 1360	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	84
PID 4532 wrote to memory of 1360	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	84
PID 1360 wrote to memory of 3284	1360	Unicorn-52019.exe	89
PID 1360 wrote to memory of 3284	1360	Unicorn-52019.exe	89
PID 1360 wrote to memory of 3284	1360	Unicorn-52019.exe	89
PID 4532 wrote to memory of 2520	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	90
PID 4532 wrote to memory of 2520	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	90
PID 4532 wrote to memory of 2520	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	90
PID 3284 wrote to memory of 2340	3284	Unicorn-24355.exe	92
PID 3284 wrote to memory of 2340	3284	Unicorn-24355.exe	92
PID 3284 wrote to memory of 2340	3284	Unicorn-24355.exe	92
PID 1360 wrote to memory of 4324	1360	Unicorn-52019.exe	93
PID 1360 wrote to memory of 4324	1360	Unicorn-52019.exe	93
PID 1360 wrote to memory of 4324	1360	Unicorn-52019.exe	93
PID 2520 wrote to memory of 3236	2520	Unicorn-31131.exe	94
PID 2520 wrote to memory of 3236	2520	Unicorn-31131.exe	94
PID 2520 wrote to memory of 3236	2520	Unicorn-31131.exe	94
PID 4532 wrote to memory of 4772	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	95
PID 4532 wrote to memory of 4772	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	95
PID 4532 wrote to memory of 4772	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	95
PID 2340 wrote to memory of 2452	2340	Unicorn-810.exe	98
PID 2340 wrote to memory of 2452	2340	Unicorn-810.exe	98
PID 2340 wrote to memory of 2452	2340	Unicorn-810.exe	98
PID 3284 wrote to memory of 4960	3284	Unicorn-24355.exe	99
PID 3284 wrote to memory of 4960	3284	Unicorn-24355.exe	99
PID 3284 wrote to memory of 4960	3284	Unicorn-24355.exe	99
PID 4324 wrote to memory of 4724	4324	Unicorn-38313.exe	100
PID 4324 wrote to memory of 4724	4324	Unicorn-38313.exe	100
PID 4324 wrote to memory of 4724	4324	Unicorn-38313.exe	100
PID 1360 wrote to memory of 4168	1360	Unicorn-52019.exe	101
PID 1360 wrote to memory of 4168	1360	Unicorn-52019.exe	101
PID 1360 wrote to memory of 4168	1360	Unicorn-52019.exe	101
PID 4532 wrote to memory of 632	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	103
PID 4532 wrote to memory of 632	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	103
PID 4532 wrote to memory of 632	4532	6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe	103
PID 3236 wrote to memory of 2500	3236	Unicorn-54095.exe	102
PID 3236 wrote to memory of 2500	3236	Unicorn-54095.exe	102
PID 3236 wrote to memory of 2500	3236	Unicorn-54095.exe	102
PID 2520 wrote to memory of 3756	2520	Unicorn-31131.exe	104
PID 2520 wrote to memory of 3756	2520	Unicorn-31131.exe	104
PID 2520 wrote to memory of 3756	2520	Unicorn-31131.exe	104
PID 2452 wrote to memory of 2924	2452	Unicorn-42995.exe	105
PID 2452 wrote to memory of 2924	2452	Unicorn-42995.exe	105
PID 2452 wrote to memory of 2924	2452	Unicorn-42995.exe	105
PID 2340 wrote to memory of 2024	2340	Unicorn-810.exe	106
PID 2340 wrote to memory of 2024	2340	Unicorn-810.exe	106
PID 2340 wrote to memory of 2024	2340	Unicorn-810.exe	106
PID 4772 wrote to memory of 2480	4772	Unicorn-13154.exe	107
PID 4772 wrote to memory of 2480	4772	Unicorn-13154.exe	107
PID 4772 wrote to memory of 2480	4772	Unicorn-13154.exe	107
PID 4960 wrote to memory of 4788	4960	Unicorn-15537.exe	108
PID 4960 wrote to memory of 4788	4960	Unicorn-15537.exe	108
PID 4960 wrote to memory of 4788	4960	Unicorn-15537.exe	108
PID 3284 wrote to memory of 2496	3284	Unicorn-24355.exe	109
PID 3284 wrote to memory of 2496	3284	Unicorn-24355.exe	109
PID 3284 wrote to memory of 2496	3284	Unicorn-24355.exe	109
PID 4724 wrote to memory of 5068	4724	Unicorn-49793.exe	110
PID 4724 wrote to memory of 5068	4724	Unicorn-49793.exe	110
PID 4724 wrote to memory of 5068	4724	Unicorn-49793.exe	110
PID 4324 wrote to memory of 4780	4324	Unicorn-38313.exe	111
PID 4324 wrote to memory of 4780	4324	Unicorn-38313.exe	111
PID 4324 wrote to memory of 4780	4324	Unicorn-38313.exe	111
PID 632 wrote to memory of 372	632	Unicorn-33000.exe	114

C:\Users\Admin\AppData\Local\Temp\6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe
"C:\Users\Admin\AppData\Local\Temp\6099730ee8888cfc6e373987a45113522e9b89fcf4d437436f9ad7287998e48c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42995.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50945.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        9⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        10⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        10⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        10⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        9⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15195.exe
        9⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
        9⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        9⤵
        
        PID:19356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        9⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        10⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
        10⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        10⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4862.exe
        10⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        9⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        9⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        9⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        9⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        8⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        9⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        10⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        10⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        10⤵
        
        PID:15896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15896 -s 436
        11⤵
        Program crash
        
        PID:19012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        10⤵
        
        PID:19004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        10⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        9⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        9⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        9⤵
        
        PID:17032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        9⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        8⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        8⤵
        
        PID:19084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        8⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        8⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
        9⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        9⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        9⤵
        
        PID:19220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33014.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        8⤵
        
        PID:18816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        8⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        8⤵
        
        PID:18852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        8⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55607.exe
        7⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        7⤵
        
        PID:19300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        9⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14925.exe
        9⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        9⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        9⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        8⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        8⤵
        
        PID:19172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42984.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
        9⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        9⤵
        
        PID:18732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        9⤵
        
        PID:19088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        8⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        8⤵
        
        PID:18068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        8⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65192.exe
        7⤵
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61281.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-888.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        8⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        8⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        8⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        7⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        7⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        8⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        8⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        8⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        7⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        7⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        7⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        7⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41203.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        6⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
        7⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
        8⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18599.exe
        9⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        9⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
        9⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        9⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        8⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        8⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        8⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        9⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        9⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        9⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        8⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        8⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        7⤵
        
        PID:18132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3005.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
        9⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
        9⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        9⤵
        
        PID:18428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        9⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        8⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        8⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3156.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        8⤵
        
        PID:18436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        6⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        7⤵
        
        PID:19448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        6⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        8⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
        8⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51770.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        7⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
        7⤵
        
        PID:18172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        7⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        8⤵
        
        PID:19132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27726.exe
        8⤵
        
        PID:18600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        7⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62231.exe
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21094.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
        6⤵
        
        PID:976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        5⤵
        
        PID:520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        6⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        8⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        6⤵
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
        5⤵
        
        PID:5884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 636
        6⤵
        Program crash
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        5⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        7⤵
        
        PID:460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 724
        8⤵
        Program crash
        
        PID:6604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 712
        7⤵
        Program crash
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19341.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        8⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        8⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        8⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        8⤵
        
        PID:19416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        7⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
        7⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        7⤵
        
        PID:19340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        7⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        7⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        6⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        6⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        8⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        8⤵
        
        PID:19308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe
        7⤵
        
        PID:18152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        7⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        7⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        7⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16784.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        6⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        7⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exe
        7⤵
        
        PID:19368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        6⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        6⤵
        
        PID:18672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        6⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47677.exe
        5⤵
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24997.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        5⤵
        
        PID:19372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        6⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        8⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
        7⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        7⤵
        
        PID:19240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58646.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        7⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        7⤵
        
        PID:19036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe
        7⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43077.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        6⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
        6⤵
        
        PID:19352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
        6⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        8⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        8⤵
        
        PID:18916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33014.exe
        7⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39901.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
        6⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exe
        6⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44796.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        6⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        6⤵
        
        PID:19228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        5⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53482.exe
        5⤵
        
        PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        7⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38800.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        6⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        7⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        7⤵
        
        PID:18864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        7⤵
        
        PID:19260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        6⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        7⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        7⤵
        
        PID:18944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
        6⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        5⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        5⤵
        
        PID:19320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3254.exe
        5⤵
        
        PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
      4⤵
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        6⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
      4⤵
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        5⤵
        
        PID:13440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        5⤵
        
        PID:16664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
      4⤵
      PID:16548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        9⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        9⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        9⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
        9⤵
        
        PID:18008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        8⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18842.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62624.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        8⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31678.exe
        8⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        6⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        8⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        8⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        7⤵
        
        PID:17452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        7⤵
        
        PID:19316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64510.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-249.exe
        6⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2714.exe
        6⤵
        
        PID:18444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        6⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7883.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        7⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        7⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62729.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        6⤵
        
        PID:18192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        6⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        5⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43369.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        6⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        6⤵
        
        PID:19372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        6⤵
        
        PID:18884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
        5⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        5⤵
        
        PID:19028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exe
        5⤵
        
        PID:16604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        6⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        8⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16295.exe
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        6⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        7⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33320.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        6⤵
        
        PID:17300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        7⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24018.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 484
        5⤵
        Program crash
        
        PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62624.exe
        5⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
      4⤵
      PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
      4⤵
      PID:16628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
      4⤵
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        6⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        8⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        8⤵
        
        PID:19160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        7⤵
        
        PID:18784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
        6⤵
        
        PID:13620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        7⤵
        
        PID:18496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        6⤵
        
        PID:18452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
        5⤵
        
        PID:13072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        5⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        7⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        7⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        6⤵
        
        PID:17168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17168 -s 464
        7⤵
        Program crash
        
        PID:18956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20807.exe
        6⤵
        
        PID:19256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50233.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        5⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        5⤵
        
        PID:18088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64187.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
        6⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        7⤵
        
        PID:18792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        6⤵
        
        PID:19432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51918.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        5⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      4⤵
      PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
      4⤵
      PID:18304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
      4⤵
      PID:932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        6⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
        6⤵
        
        PID:17476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        5⤵
        
        PID:14384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
        5⤵
        
        PID:18652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30720.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        5⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        5⤵
        
        PID:19440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
      4⤵
      PID:8672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        5⤵
        
        PID:19396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
      4⤵
      PID:13176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47511.exe
      4⤵
      PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      4⤵
      PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
      4⤵
      PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
      4⤵
      PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
      4⤵
      PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
    3⤵
    PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
    3⤵
    PID:9416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
    3⤵
    PID:14292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
    3⤵
    PID:18196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
    3⤵
    PID:18980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11220.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        8⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        8⤵
        
        PID:19204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
        7⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        7⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        7⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        8⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        8⤵
        
        PID:18924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21950.exe
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
        7⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
        7⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        6⤵
        
        PID:17916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35585.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        8⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        7⤵
        
        PID:18840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        7⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        6⤵
        
        PID:19092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29760.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44282.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22746.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        5⤵
        
        PID:17524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        5⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        6⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        7⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        7⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        7⤵
        
        PID:19328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59937.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        6⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        6⤵
        
        PID:18696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3694.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        6⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        7⤵
        
        PID:18892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        6⤵
        
        PID:19340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        5⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        5⤵
        
        PID:18568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9160.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44796.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        7⤵
        
        PID:19256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        7⤵
        
        PID:19436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        6⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        6⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
        6⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe
        6⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-815.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        6⤵
        
        PID:18708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        5⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        5⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        5⤵
        
        PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47425.exe
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
      4⤵
      PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
      4⤵
      PID:18032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:64
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 720
        6⤵
        Program crash
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        7⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        6⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59894.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        5⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49186.exe
        5⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        5⤵
        
        PID:18104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        5⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
      4⤵
      PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
      4⤵
      PID:14732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21640.exe
      4⤵
      PID:18244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21501.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        7⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        6⤵
        
        PID:18828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        6⤵
        
        PID:19332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        5⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        6⤵
        
        PID:17984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23285.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        5⤵
        
        PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
      4⤵
      PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        5⤵
        
        PID:19140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      4⤵
      PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8142.exe
      4⤵
      PID:19212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
      4⤵
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25585.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        6⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
      4⤵
      PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      4⤵
      PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
      4⤵
      PID:19452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
      4⤵
      PID:1188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
    3⤵
    PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        5⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        5⤵
        
        PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
      4⤵
      PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
      4⤵
      PID:17468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
    3⤵
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
      4⤵
      PID:14368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      4⤵
      PID:18640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
    3⤵
    PID:10192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
    3⤵
    PID:14260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
    3⤵
    PID:18024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
    3⤵
    PID:17068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        6⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        8⤵
        
        PID:18980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        7⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        7⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35817.exe
        6⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        7⤵
        
        PID:18768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        6⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        6⤵
        
        PID:19248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        7⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        7⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        6⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        5⤵
        
        PID:18184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
      4⤵
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        5⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        7⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        7⤵
        
        PID:19044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
        6⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39901.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25728.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        5⤵
        
        PID:18056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        5⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        6⤵
        
        PID:18908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        5⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44728.exe
      4⤵
      PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63961.exe
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
      4⤵
      PID:13236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
      4⤵
      PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
      4⤵
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        6⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        6⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        5⤵
        
        PID:18064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
        5⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3156.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        5⤵
        
        PID:18560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      4⤵
      PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      4⤵
      PID:18400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        5⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        5⤵
        
        PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
      4⤵
      PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
      4⤵
      PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
      4⤵
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49395.exe
      4⤵
      PID:2248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
    3⤵
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe
      4⤵
      PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        5⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        5⤵
        
        PID:19052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
      4⤵
      PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
      4⤵
      PID:18168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
    3⤵
    PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
      4⤵
      PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
      4⤵
      PID:18776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
    3⤵
    PID:12364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
    3⤵
    PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
    3⤵
    PID:1184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15470.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        7⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        7⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        6⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        6⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        6⤵
        
        PID:18900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        6⤵
        
        PID:19000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        5⤵
        
        PID:19072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45076.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        5⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        5⤵
        
        PID:16460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      4⤵
      PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        5⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        5⤵
        
        PID:696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      4⤵
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
      4⤵
      PID:13828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      4⤵
      PID:18412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21501.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        6⤵
        
        PID:19284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        5⤵
        
        PID:17488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
      4⤵
      PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
      4⤵
      PID:19116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
    3⤵
    PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      4⤵
      PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28678.exe
      4⤵
      PID:12956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      4⤵
      PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
      4⤵
      PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe
    3⤵
    PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
    3⤵
    PID:11220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe
    3⤵
    PID:15384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
    3⤵
    PID:19124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55901.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        6⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        5⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        5⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        5⤵
        
        PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
      4⤵
      PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14593.exe
      4⤵
      PID:13060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
      4⤵
      PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13005.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
      4⤵
      PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
        5⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        5⤵
        
        PID:18876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
        5⤵
        
        PID:19420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
      4⤵
      PID:17376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
    3⤵
    PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
    3⤵
    PID:10560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
    3⤵
    PID:15612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16310.exe
    3⤵
    PID:19108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
    3⤵
    PID:224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37597.exe
    3⤵
    PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
      4⤵
      PID:14480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
      4⤵
      PID:544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
    3⤵
    PID:7864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42668.exe
    3⤵
    PID:10960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
    3⤵
    PID:15244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
    3⤵
    PID:18264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
    3⤵
    PID:5644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27491.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27491.exe
  2⤵
  PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
    3⤵
    PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
      4⤵
      PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46645.exe
      4⤵
      PID:16480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
    3⤵
    PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
    3⤵
    PID:12452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56402.exe
    3⤵
    PID:16948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
    3⤵
    PID:5352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
  2⤵
  PID:9760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
  2⤵
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6282.exe
  2⤵
  PID:16996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
  2⤵
  PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4152 -ip 4152
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2180 -ip 2180
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 64 -ip 64
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 460 -ip 460
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5884 -ip 5884
1⤵
PID:7692

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 19260 -ip 19260
1⤵
PID:6172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-13042.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
Size 184KB
SHA256 1740457e3e90f444bd1d1d5f8397c2ac56d23d06ee497fcffc70d4293643efbf
MD5 9417bd893abdf96903d1cf1b88809926
SHA1 8aff8723de8fa4b3b0658e5cc7a6c4dc4fe963eb
SHA512 87371111793c35adf5cc1d028321ff32c503f388c2234c453c1e8ca060d297ff459d5121788b15101c27ec73d150c87c1de9ef0a9bd409bfe0db0f025b5db0c4
SSDEEP 3072:rzb/qpoTpKg+3TwwTCyJz2jWclDvnqnviuA:rzEoWjww7zsW0DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13154.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
Size 184KB
SHA256 e69fc9a3c9b20c240e6c727e07e3b471a29b8303bec3b08dd0a4282b5a18536d
MD5 b9326dadfb0d6b2b7400fc2f3fb53dcd
SHA1 7b79beb8fe35e519ec022e6a3fd6cef51c915b92
SHA512 542930ec7ed67718c23fe0adeb8e9be8ef9cf3f27e5bdf957784adef15872a3a72f89c9cd78ffbcd3c08324ee5f863695ece09bd578478d62585105b1db9afa5
SSDEEP 3072:szb/qpoTpDg+3TwwTCyJz2jWclDvnqnviuA:szEoDjww7zsW0DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15537.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15537.exe
Size 184KB
SHA256 8dfab0921e22cc4c6e4c2e29389b9c115072d4764c6f8661574e2a429505e7e5
MD5 319da567c9957fdc2860b75f77eb7aea
SHA1 678de45361fc263d4ce08228f90ee181fcabf5f0
SHA512 0bbb57a1905cc5a68b88ab04f4d17819a74c5277636d2958f486ffa84f9de629264779735696b8dd43840ad5a5bd27b13da2c46f02577bbcc7bdaaa67796441f
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jWClDvnqnviuA:rzEoDjwe7zsWWDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17623.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
Size 184KB
SHA256 aa501ca159a39878829cf0e0d236f5daa2a76001e25ef0bcd7e3a5d24c6986ba
MD5 f5346e0ccaaae5c9ed6112bd8e950007
SHA1 01f93127555b21fed123857c534a5a60efb2994f
SHA512 ae8aaf16878981d225e58b32ceff9460035bc18ecedd165f6c9ac1f09d8b6226314e535de0c64e16ef08441e97a391f637b51780700841623d485941a3fac80c
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWPlDvnqnviuA:rzEoDjww7zsWNDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21973.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
Size 184KB
SHA256 46dc7ee7cc01e8d39c14f95ab9c9b607fc1e5f46d57caa7a6c27e63efe2a1af5
MD5 aea093288bab2805c0228b5930db3aef
SHA1 35fa50ef944004c02cedd6280db25e4f29fd1a4b
SHA512 e84444235029d322b17f967d79f354a439269d596c0f5ce5d01d3d50bba7e457d421ba63832cc0f96c242c4d388d36990fd841f74a434dea948014d07c71ecb7
SSDEEP 3072:rzb/qpoTpDg+RTwwTCyJz2jWVlDvnqnviuq:rzEoDRww7zsWvDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-24010.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
Size 184KB
SHA256 97469ecccc8620fd0990f143793129c7d1450611ded548738fcbc1e98ef0458a
MD5 59efea3d120fd30567d1428c8eea391a
SHA1 775fa9cdf0035b774850f560415f66946d10f3fb
SHA512 a27e40ad818f94ad9d39a22d6baa5f8522e03e1c90e68db8d80c81124a0bc1ea86f6119f6e500ee3e86c429ff1b6cd7ee2e18c6ddaa9f61fb2e390d3066197ba
SSDEEP 3072:rzb/qpoTpSg+3TwwTCyJz2jWUlDvnqnviuA:rzEo+jww7zsWMDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-24355.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24355.exe
Size 184KB
SHA256 d62b40bc7ddf7648aacc5f901850281fd5846530f66dea0200224e99e6867b50
MD5 6c90443ba6b67668097333cdbb765e13
SHA1 12f3d3dd535d4bc70ab34aa1a6656e13e1104ec7
SHA512 a697ca17873333d29aa6d5d6e1ae6d970dc1d7d96946cf1f49c2cda9c463f00ee02d30190af47c8e6a38cff5c505b4e08161c7d9e8d6e37749a661c23555b904
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jW0lDvnqnviuA:rzEoDjwe7zsWsDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2538.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
Size 184KB
SHA256 4d92ace614dbcb8d771a96d4ceee3404af2835f7391856480b751f4e938ad615
MD5 a2b9ad25572c020b7b85b0f2a8e41079
SHA1 b161b06101855da0b69479a469f3157ed5aaa180
SHA512 c318e53363c247e4fba13590dce10dc96ef1afb633a341a11b8d2559e7a512b77da9b090cdbbf92806797bf023fcfdbe6611b2bd6990308e5cd3f65431dacad4
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWVlDvnqnviuq:rzEoDjww7zsWvDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30141.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
Size 184KB
SHA256 cc52eba4f0cebb5e8a9062dc337843e21c3cd9163468e58390233bf5bd9d6df2
MD5 886a6023dffebb7a5b2caa9d95058411
SHA1 7c94c42aa0e17cc3c17f2ec92d6beb37edbadaa8
SHA512 5684a52f39fae82b1237be4045aa4224472c2d6da22ed7412a4d6f92a23cd1d4460dbb680ad49e047c68d151b1ae50c7740c047ec1c20e5dfd24a9fe16d78531
SSDEEP 3072:rzb/qpoTpDg+3TwwTCy2z2jWdlDvnqnviuA:rzEoDjwwYzsW3DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31131.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
Size 184KB
SHA256 4021ff8c5e01a5260b4599b19452d9b33893ffedb7e760d88bd356e2ca5cda52
MD5 e298af535cefef16eb0f87965e429875
SHA1 5e24baa047172bbb427650e7b445f60f76e40631
SHA512 cd1a5716d5714a9ce7ee14d3e0552991424a5bc4200c44e866b19b0a4e2f2b2ae9033e62ba510bf8e5792d7e35060df478f72be32fcd988683961f2371d9bc18
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWUlDvnqnviuA:rzEoDjww7zsWMDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33000.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
Size 184KB
SHA256 b590e55a31d4ec65f94af676e1acf6e4b82c2b68223f7a741a37d8023bc538a8
MD5 bde65e5522a8c1a9f27cf5d6b1ae5212
SHA1 9d16943e306328d0fcc43d174481553d4d6dc1c4
SHA512 49980d0411242c37e66a204d929032348584bb1a0559ab54314e74b62be84718991bf426489385a5db6c622daa031a4e376356b9987aa1890e531ac5de6a6611
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWmlDvnqnviuA:rzEoDjww7zsWKDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38313.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
Size 184KB
SHA256 9c9954f9cf0c190e2c5b3119e342d01bcf709b6c094fda2b7ceecde73c5575b7
MD5 ffd5425de63195c07d48a9e40b97b206
SHA1 13eb2016762b0d65c683a165644056b843137198
SHA512 5a2bfa8d1df403641db3344f27092331867d589bb3bc86cce9744b4a8c9cd2012b3012142ccdfe4db25204352c08a43bd013e736873979ae572960c2d83118a4
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jW0lDvnqnviuA:rzEoDjww7zsWsDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39579.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
Size 184KB
SHA256 282e089a2add60cd27898231e8f119b6a60482b159052f9e377233d9152bca97
MD5 5a1dce620966fedf0afd732b5adc9aa9
SHA1 312e1369aba4723f57a3d290e2688c81644ea94f
SHA512 f24907f86d3fbeb29814cc5475d9b1df67c219ee5666a3d6ab49c4ea2bd154ac7f56a01eee3c0a2ec6de08687fab44951fb5877c73cc3ef154e52a6dfa85e56b
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2MW0lDvnqnviuA:rzEoDjww7zDWsDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42995.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42995.exe
Size 184KB
SHA256 48820775573176547030c625e040ba5020c7c3a24c7809720e3a631b39362935
MD5 2ee6745b30086482489f9953aa7d4660
SHA1 d5c2967b7572aafc872c3f2fdefc24ca2fa10159
SHA512 7136e2d8932490b04f91a83c852cfe3e03095bdd2ea5a6dbe65e5ada10e5177c40f12233ccc8f0873aee53bd64e040730185e41cfbc00e68b14c25dedefbcb5d
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jWllDvnqnviuD:rzEoDjwe7zsW/DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45875.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
Size 184KB
SHA256 8a94ff4ff9c43122f090d208b90756f6a4d690a919cd942c250febe6bfe1079c
MD5 0426228df9f673b2c86a1501ac0c5f79
SHA1 4ac1cc470dbf3f66e2e6f0a27f9ccae10c01d58a
SHA512 aa65bdda8973ff7a371419690dba58dae4220975369d5063d7ba912003117d76d31513e7e3e17795521b6e91993894299ba19c4fd725c9711e54da09824c4d95
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jW1lDvnqnviuD:rzEoDjwe7zsWPDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46761.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46761.exe
Size 184KB
SHA256 1d2d52bec89b1805bb8787d34fae0e873e9f8c251c819ef7adaaad08661a3500
MD5 3e8afe50f213f6c16fe3fe72a88e39de
SHA1 b1b159848c010d84c415360976898c04d7bc406b
SHA512 6b5d1cd2e0f5740260c56f17273599b21f6ca9d43673ab4478f5a9c6b3f881f269a58b1ba9b9c7a75726d93b66407e73a568e8771703348d4c6b99d8447acff5
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jW2lDvnqnviuA:rzEoDjwe7zsWaDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49170.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
Size 184KB
SHA256 93979a4c3aea4d4115db6e5f8f59bf2769550ce91abef3cf6edca4e60fb51ec7
MD5 bce5f402c39a7e14a1aa679acfdbd939
SHA1 662979059ac8627a69aba5414083a4f435bdde23
SHA512 0f540e1d33c3144eda69cef69567ea2343b37c984bf8e213fc3c7a68dd21f4a9c69a09a09e1b631b25bad63b776f8e6218a4ede84cd7b9fcbc5964bc0c01f5d1
SSDEEP 3072:rzb/spoTpDg+3TwwTCyJz2jW0lDvnqnviuA:rzeoDjww7zsWsDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49362.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
Size 184KB
SHA256 247166a7e125b83e10dc76acba7198be9197d8e80b449057933ea20c0b754438
MD5 5c2abc7014dcc99a332e5d8ad7eaa961
SHA1 30fba475120a7f6cf2311751a12c277116c5ee54
SHA512 6f84ff0e49fc274c84f9f6c2e37d2921d54117a9b2a8581372c87e9b790415db37ef519db594c096d4cb55f6da4f055852efd0dd4b0fc5e8708df5e064ad6a3b
SSDEEP 3072:szb/WoTpDg+3TwwTCyJz2jWclDvnqnviuA:szyoDjww7zsW0DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49793.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
Size 184KB
SHA256 3ac4ecab99874fa9fbc39dc670c6eae1a60cb39c3b1574c5d1d49c65905a7d85
MD5 e5c123f9040f7bb970f6169e4d5a910d
SHA1 6208f78a0da4ee94ed16687735fef1d57d0bae02
SHA512 e53941b9caf8e57d1e9956d7a4b76a3ddd2457ffb4f08ef5762e152dd06234811ddc45f2cccec62b620ecac13a60df11a93031bd70cd294b01ff9edfcae4b7a7
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWklDvnqnviuA:rzEoDjww7zsWcDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50945.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50945.exe
Size 184KB
SHA256 55efcf0645b1c64cb63b9dbd8c7250ca7da555a240be7c4b1ad87f6d69dbbbb8
MD5 9096af221bb51b9659da9824c56abff8
SHA1 84babd7feedb6780709ba22a8f2a3f1796118909
SHA512 c5afd16545d019433a3037a15fe92023f6720fb7fb555c79163f7ac9639987a02dee8a1f2742280077eaff24152d845dc56531f7ffd34c9577a5bbe72fac2d57
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jWAlDvnqnviuD:rzEoDjwe7zsW4DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51534.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
Size 184KB
SHA256 5add76a8fe4f4bd4aa5f4ab0dee2776011a6a644bb040010fcf722775a29e5d8
MD5 3ad30c69f943d4547fba50d78a3d0e76
SHA1 aebc76a6ec5847595c262bd24390a7afdb819f25
SHA512 2ef787b6c404cfd57cb28e6113f580991260204324a6dd64e7e9b4406a4a574242b1fe48fb2afd7698a7c214d4c1ca9eb76f957e40d9f0f5ee973be618105e82
SSDEEP 3072:zzb/qpoTpDg+3TdLeTCyJz2jW1lDvnqnviuD:zzEoDjRe7zsWPDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52019.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
Size 184KB
SHA256 2a3f2cf85bbd5ab6b4b0ade2d479e607e71dae40bc12fb9aec8ba9581fc97a46
MD5 c6863d28bc2358facf94bf68670a26fb
SHA1 5ff086f023fb0a4cae25b4d897a78c51afb10f89
SHA512 3afc3003d312af7937afb0627802c7b898de299ea03ce9d4ffa1831e2ff21a04629f71809e796da7a149b35235ec8ae954daf43a92d6e9208a5e7a4ea57818fe
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jW0lDvnqnviuA:rzEoDjww7zsWsDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52460.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
Size 184KB
SHA256 bc1a49b8df719826175fda18fa1be63a692a6a02c867f04d00194cb42fd0e9f1
MD5 bbccf450f2299241fa735ec06582a7dd
SHA1 5dc9cfc01e995a49edd78875bc25f95a03d7a641
SHA512 62b9d0f17557c7aab8d173e9d8b2b19bccb2416e390bc04f6ad43d65bb09880bd0abffc54245fb412d37cd77d66682a3ba22b64489daa79fc98a3911e6a5961a
SSDEEP 3072:rzb/qpoTpUg+3TweTCyJz2jWllDvnqnviuD:rzEoEjwe7zsW/DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54095.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
Size 184KB
SHA256 cd994402c27a4e122d70f098241ad6911f06c01054ab808ab7df5e163d0f7596
MD5 91a87532b7e0b6c212941ff47bc7fe43
SHA1 049489f4a41c7034f349aede3998b40d6ef5e4ac
SHA512 01c038c6531d29f84e9ba768dace6d4e736b3866c40a4bde951db0e802a966dbdebbd51ce47ff305b17b320737b2e9c1a064c80b3c64001c875706f3ffb0377b
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWVlDvnqnviuA:rzEoDjww7zsWvDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-55989.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
Size 184KB
SHA256 7976a2f85f427a5541933f9467d3121ac4b90163fb1c04002d701d136fb58eb2
MD5 c2bcf29f988c163b870f81ba81277d27
SHA1 2bccc97c29b0ee1317c0cd801ea96f5f722e2f4f
SHA512 0c844663e7d0462d2b4394bd689bb039f4b1efd5500377eef249acad2c9d888c006c2cbb961d328092f4805d69b98955fe4b6356bccbead0ce60daaea6dfc45d
SSDEEP 3072:rzb/qpoTpDg+3TveTCyJz2jW+lDvnqnviuD:rzEoDjve7zsWCDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56783.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
Size 184KB
SHA256 aa3ba098ef999983bde37645d7babd27d2e2f76585befd74d7fe443d85d39cd9
MD5 343250a8f04e0b11aeef631ee6047788
SHA1 f72100faadabdf04d0a7794451616306a527e67e
SHA512 77c748ad142aeb220354a637eccdf780dc6df02c6f869ad9ef871c32ace8ef815d2c354053fdbe67eea7c594366d94550cd9a7fdc287eb728caedd3fbb0b0fc1
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2MWvlDvnqnviuA:rzEoDjww7zDWtDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57722.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
Size 184KB
SHA256 237f73793ca7cacde7eafbad19fe0eb3aa559911cb6ecef4f7a60c184e4f8bb0
MD5 5f3043ffe7b2bd925e13d0bd7a059a89
SHA1 49393ae36e0c4d1b28644e8d1e9d3aca39825108
SHA512 7e372e342e733d29d7dacaedfd9652f278695cd392ee6d59cee1d1f1ffcd96a8ea1f8a901f6900dacbb3a8a8b7c680df4f45c403e92eaf26f119c453c2a6be5c
SSDEEP 3072:rzb/qpoTpDg+3TveTCyJz2jW0lDvnqnviuD:rzEoDjve7zsWsDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-60233.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
Size 184KB
SHA256 f5829cfffe72b480e51f64422daef56443f2b2f9b2f431981b59c706de59e5ad
MD5 832f3325aff03ce5bb7f0288f828d425
SHA1 d5b9968dfe0265bc84df660afedbb90c58819cce
SHA512 86daea804467eb705db569b5454642f250d0af09e36e6b2a09023b66e82709d06180103757d88c7702c0413c6ea8d176c476b14796d38a753daa1344967f611b
SSDEEP 3072:czb/qpoTpDg+3TMwTCyJz2jWclDvnqnviud:czEoDjMw7zsW0DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-60867.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
Size 184KB
SHA256 76435bf525025316c8b1543951672c427027ca080b2559ce4a6c48a665c05961
MD5 67a4252ebdff5e91b41229996bbb022d
SHA1 3bf88ca50b586b7f2b0b906b803dced1054a28dd
SHA512 5a5e8f266225140a1c53a2350cc3704139091cd1621357c6a400775989c736c5a79a3fd551f514570e97f3816187c35fe2a250e546a5d9d1cb9610f3abac417c
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWqlDvnqnviuA:rzEoDjww7zsW+DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63560.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63560.exe
Size 184KB
SHA256 69882a4bb2912d063e0207cc7c50cde553e61312e32dc98c3e2132042754940c
MD5 4486205d95c9c0176351a50beebbfc0f
SHA1 cf0d5d8731dd24292033ef74d1d14f46870645f0
SHA512 5ed13a158ea2b9073369dc5d1228ed3ef89dfea9a6e8980c5ad57b6e8b1373b07f3337f100819fd2488961de3c92d9965b800e77212a12f57371badfcae856c7
SSDEEP 3072:rzb/qpoTpDg+3TwwTCnJz2jWVlDvnqnviuA:rzEoDjwwMzsWvDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65143.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
Size 184KB
SHA256 c7ffd01c8e4bd1ef4c20dd0d860bfb43d03df9d606a15a2ed7cef8b0a0941204
MD5 6cc3a0c476c9f7fd8c7507d1f12279fc
SHA1 f1c053a25f3a62474984a36f2afb1077f5494652
SHA512 30c3c784451ec28edbe14aa67dad5f7dd28fe3adaf2f089b382671818ff65647e0b33fa97f457b2e62da6799c4d957b06889047bcd354d8fc14cc0c71cde28f1
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jWClPvnqnviuA:rzEoDjwe7zsWWPPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7774.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
Size 184KB
SHA256 54ff603a2f11f574b52892cd21ebc7c3c7e979727bf15529bb72fc02a1a8e0fb
MD5 5fe4be63f8da5dc683ca1164910e2b77
SHA1 e613cc5ea790e0dbad4e9969eae9b64a78a1a213
SHA512 14f9578ad89cb7dffc4b80c676aad362b55abb52ccf56a9a8c1e6d50998ff5151d28ee607668d6d66fdec255b2d7a2212b72b88388ee19d4aaedf37f29a6c145
SSDEEP 3072:mzb/qpoTpDg+3TwwTCyJz2jWklDvnqnviuA:mzEoDjww7zsWcDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-810.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
Size 184KB
SHA256 55a9e995ab843c75c2e2cd333b3b53a305a23121e32ce567494ae663ab116f11
MD5 cbed3904268c992ee5a76ff6d411a638
SHA1 4135940bacafc62eb93440e2c0dc95147bd90871
SHA512 1045c817fe1dedf843bb3c1d7a72d1d105d7b2dadfef4676f48801332d2c1347ec15721548bbc73ba24f8a79becb00d9f62560b2da5a817acb0dccb136f8b7a8
SSDEEP 3072:rzb/qpoTpDg+3TweTCyJz2jW0lDvnqnviuD:rzEoDjwe7zsWsDPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9315.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
Size 184KB
SHA256 6402a48c208d37fd72374ece97c50482db17968de18c7ff96ba849cb745908c2
MD5 c5b373eadac05155266546d8490d1cb1
SHA1 c9b375abd0a176c85ea7c5339f3dbd01d36d1662
SHA512 670ac567942e45edcd800de9e589849b103e5a10f1ad83ed044a19874ab47a6ab61861f87297d22f417dae33917873378e84d581e99a09dfef880fe2b978fd87
SSDEEP 3072:rzb/qpoTpDg+3TwwTCyJz2jWdlDvnqnviuA:rzEoDjww7zsW3DPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads