fc2507d8c0ae032b8ae26982731abe2a2f777513ac9cbe85715ab2c0c02631b5

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe
Size 184KB
Sample240603-ra7dfsab67
SHA256 fc2507d8c0ae032b8ae26982731abe2a2f777513ac9cbe85715ab2c0c02631b5
MD5 a5b4a4f3d130121332e117d2f626ba60
SHA1 17c5e099d01c662f495ae7b5ea0fc6e3fade4808
SHA512 bbca9f3cddc1f39fe3358eb49c9360d2239e1ef70f525becdaf64484c40a557b29748ceba3d98c39742df6728862481923509683f2e63ab2ea7452bbd2e48a5c
SSDEEP 3072:gPGsJion5nvsdQSfWW5NAVa1lvnq4Xiui:gP6oJYQSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4560	Unicorn-16137.exe
4228	Unicorn-62981.exe
4108	Unicorn-51284.exe
5056	Unicorn-57273.exe
3212	Unicorn-65441.exe
4140	Unicorn-59311.exe
2040	Unicorn-57828.exe
1924	Unicorn-52561.exe
380	Unicorn-3360.exe
1608	Unicorn-49032.exe
2016	Unicorn-11528.exe
4360	Unicorn-23781.exe
1228	Unicorn-21350.exe
3756	Unicorn-39468.exe
4828	Unicorn-7615.exe
2900	Unicorn-39069.exe
3048	Unicorn-35539.exe
4536	Unicorn-39261.exe
4684	Unicorn-47429.exe
4580	Unicorn-51513.exe
4980	Unicorn-31647.exe
1660	Unicorn-53551.exe
2424	Unicorn-14564.exe
1544	Unicorn-63936.exe
1468	Unicorn-18265.exe
3764	Unicorn-6567.exe
2392	Unicorn-54259.exe
2904	Unicorn-63189.exe
3744	Unicorn-57059.exe
2292	Unicorn-62924.exe
2492	Unicorn-59747.exe
1136	Unicorn-25229.exe
3728	Unicorn-1279.exe
2172	Unicorn-41543.exe
3692	Unicorn-8316.exe
2560	Unicorn-25805.exe
1844	Unicorn-30443.exe
4652	Unicorn-46780.exe
3220	Unicorn-37673.exe
1004	Unicorn-54564.exe
1540	Unicorn-46033.exe
3884	Unicorn-2954.exe
1332	Unicorn-9084.exe
1256	Unicorn-22223.exe
3740	Unicorn-42909.exe
5156	Unicorn-35295.exe
5164	Unicorn-49031.exe
5252	Unicorn-45139.exe
5284	Unicorn-46920.exe
5272	Unicorn-21719.exe
5300	Unicorn-59437.exe
5216	Unicorn-22681.exe
5316	Unicorn-2068.exe
5232	Unicorn-30849.exe
5352	Unicorn-64076.exe
5360	Unicorn-18405.exe
5384	Unicorn-2239.exe
5336	Unicorn-1306.exe
5600	Unicorn-2571.exe
5584	Unicorn-60205.exe
5632	Unicorn-43293.exe
5640	Unicorn-43293.exe
5664	Unicorn-27511.exe
5708	Unicorn-31233.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
6780	5284	WerFault.exe	158
8616	7048	WerFault.exe	243
9384	3404	WerFault.exe	374
16824	17024	WerFault.exe	826
6072	16512	WerFault.exe	812
7256	18804	Process not Found	1040
20320	1208	Process not Found	1062

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
7280	svchost.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
19484	Process not Found
20060	Process not Found
20076	Process not Found
20084	Process not Found
20104	Process not Found
20112	Process not Found
20116	Process not Found
20124	Process not Found
20132	Process not Found
20140	Process not Found
20148	Process not Found
20156	Process not Found
20164	Process not Found
20176	Process not Found
20184	Process not Found
20192	Process not Found
11740	Process not Found
508	Process not Found
11728	Process not Found
11752	Process not Found
20212	Process not Found
11784	Process not Found
20024	Process not Found
19496	Process not Found
19952	Process not Found
10832	Process not Found
20264	Process not Found
9800	Process not Found
19604	Process not Found
11068	Process not Found
11732	Process not Found
20228	Process not Found
19908	Process not Found
20048	Process not Found
11800	Process not Found
10828	Process not Found
19468	Process not Found
12188	Process not Found
19996	Process not Found
10744	Process not Found
19620	Process not Found
10716	Process not Found
11076	Process not Found
20236	Process not Found
9748	Process not Found
12100	Process not Found
9820	Process not Found
4324	Process not Found
20000	Process not Found
17192	Process not Found
17028	Process not Found
12228	Process not Found
12220	Process not Found
12232	Process not Found
20308	Process not Found
20220	Process not Found
20244	Process not Found
20252	Process not Found
20360	Process not Found
20368	Process not Found
20272	Process not Found
20280	Process not Found
10088	Process not Found
10824	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3864	dwm.exe
Token: SeChangeNotifyPrivilege	3864	dwm.exe
Token: 33	3864	dwm.exe
Token: SeIncBasePriorityPrivilege	3864	dwm.exe
Token: SeCreateGlobalPrivilege	10224	dwm.exe
Token: SeChangeNotifyPrivilege	10224	dwm.exe
Token: 33	10224	dwm.exe
Token: SeIncBasePriorityPrivilege	10224	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe
4560	Unicorn-16137.exe
4108	Unicorn-51284.exe
4228	Unicorn-62981.exe
5056	Unicorn-57273.exe
3212	Unicorn-65441.exe
4140	Unicorn-59311.exe
2040	Unicorn-57828.exe
1924	Unicorn-52561.exe
380	Unicorn-3360.exe
1608	Unicorn-49032.exe
4360	Unicorn-23781.exe
2016	Unicorn-11528.exe
3756	Unicorn-39468.exe
4828	Unicorn-7615.exe
1228	Unicorn-21350.exe
2900	Unicorn-39069.exe
4536	Unicorn-39261.exe
4684	Unicorn-47429.exe
1544	Unicorn-63936.exe
4980	Unicorn-31647.exe
2424	Unicorn-14564.exe
4580	Unicorn-51513.exe
1660	Unicorn-53551.exe
2292	Unicorn-62924.exe
3744	Unicorn-57059.exe
2392	Unicorn-54259.exe
3764	Unicorn-6567.exe
2904	Unicorn-63189.exe
1468	Unicorn-18265.exe
2492	Unicorn-59747.exe
1136	Unicorn-25229.exe
3728	Unicorn-1279.exe
2172	Unicorn-41543.exe
3692	Unicorn-8316.exe
2560	Unicorn-25805.exe
1844	Unicorn-30443.exe
4652	Unicorn-46780.exe
3220	Unicorn-37673.exe
1004	Unicorn-54564.exe
1540	Unicorn-46033.exe
1332	Unicorn-9084.exe
3884	Unicorn-2954.exe
1256	Unicorn-22223.exe
3740	Unicorn-42909.exe
5164	Unicorn-49031.exe
5156	Unicorn-35295.exe
5284	Unicorn-46920.exe
5300	Unicorn-59437.exe
5316	Unicorn-2068.exe
5232	Unicorn-30849.exe
5272	Unicorn-21719.exe
5216	Unicorn-22681.exe
5252	Unicorn-45139.exe
5352	Unicorn-64076.exe
5336	Unicorn-1306.exe
5360	Unicorn-18405.exe
5384	Unicorn-2239.exe
5600	Unicorn-2571.exe
5584	Unicorn-60205.exe
5640	Unicorn-43293.exe
5632	Unicorn-43293.exe
5724	Unicorn-33270.exe
5664	Unicorn-27511.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4560	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	101
PID 4540 wrote to memory of 4560	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	101
PID 4540 wrote to memory of 4560	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	101
PID 4560 wrote to memory of 4228	4560	Unicorn-16137.exe	105
PID 4560 wrote to memory of 4228	4560	Unicorn-16137.exe	105
PID 4560 wrote to memory of 4228	4560	Unicorn-16137.exe	105
PID 4540 wrote to memory of 4108	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	106
PID 4540 wrote to memory of 4108	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	106
PID 4540 wrote to memory of 4108	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	106
PID 4108 wrote to memory of 5056	4108	Unicorn-51284.exe	110
PID 4108 wrote to memory of 5056	4108	Unicorn-51284.exe	110
PID 4108 wrote to memory of 5056	4108	Unicorn-51284.exe	110
PID 4228 wrote to memory of 3212	4228	Unicorn-62981.exe	111
PID 4228 wrote to memory of 3212	4228	Unicorn-62981.exe	111
PID 4228 wrote to memory of 3212	4228	Unicorn-62981.exe	111
PID 4560 wrote to memory of 2040	4560	Unicorn-16137.exe	113
PID 4560 wrote to memory of 2040	4560	Unicorn-16137.exe	113
PID 4560 wrote to memory of 2040	4560	Unicorn-16137.exe	113
PID 4540 wrote to memory of 4140	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	112
PID 4540 wrote to memory of 4140	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	112
PID 4540 wrote to memory of 4140	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	112
PID 5056 wrote to memory of 1924	5056	Unicorn-57273.exe	114
PID 5056 wrote to memory of 1924	5056	Unicorn-57273.exe	114
PID 5056 wrote to memory of 1924	5056	Unicorn-57273.exe	114
PID 4140 wrote to memory of 380	4140	Unicorn-59311.exe	115
PID 4140 wrote to memory of 380	4140	Unicorn-59311.exe	115
PID 4140 wrote to memory of 380	4140	Unicorn-59311.exe	115
PID 4108 wrote to memory of 1608	4108	Unicorn-51284.exe	116
PID 4108 wrote to memory of 1608	4108	Unicorn-51284.exe	116
PID 4108 wrote to memory of 1608	4108	Unicorn-51284.exe	116
PID 2040 wrote to memory of 2016	2040	Unicorn-57828.exe	117
PID 2040 wrote to memory of 2016	2040	Unicorn-57828.exe	117
PID 2040 wrote to memory of 2016	2040	Unicorn-57828.exe	117
PID 3212 wrote to memory of 4360	3212	Unicorn-65441.exe	118
PID 3212 wrote to memory of 4360	3212	Unicorn-65441.exe	118
PID 3212 wrote to memory of 4360	3212	Unicorn-65441.exe	118
PID 4560 wrote to memory of 1228	4560	Unicorn-16137.exe	119
PID 4560 wrote to memory of 1228	4560	Unicorn-16137.exe	119
PID 4560 wrote to memory of 1228	4560	Unicorn-16137.exe	119
PID 4540 wrote to memory of 3756	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	120
PID 4540 wrote to memory of 3756	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	120
PID 4540 wrote to memory of 3756	4540	a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe	120
PID 4228 wrote to memory of 4828	4228	Unicorn-62981.exe	121
PID 4228 wrote to memory of 4828	4228	Unicorn-62981.exe	121
PID 4228 wrote to memory of 4828	4228	Unicorn-62981.exe	121
PID 1924 wrote to memory of 2900	1924	Unicorn-52561.exe	122
PID 1924 wrote to memory of 2900	1924	Unicorn-52561.exe	122
PID 1924 wrote to memory of 2900	1924	Unicorn-52561.exe	122
PID 5056 wrote to memory of 3048	5056	Unicorn-57273.exe	123
PID 5056 wrote to memory of 3048	5056	Unicorn-57273.exe	123
PID 5056 wrote to memory of 3048	5056	Unicorn-57273.exe	123
PID 380 wrote to memory of 4536	380	Unicorn-3360.exe	124
PID 380 wrote to memory of 4536	380	Unicorn-3360.exe	124
PID 380 wrote to memory of 4536	380	Unicorn-3360.exe	124
PID 1608 wrote to memory of 4684	1608	Unicorn-49032.exe	125
PID 1608 wrote to memory of 4684	1608	Unicorn-49032.exe	125
PID 1608 wrote to memory of 4684	1608	Unicorn-49032.exe	125
PID 4360 wrote to memory of 4580	4360	Unicorn-23781.exe	127
PID 4360 wrote to memory of 4580	4360	Unicorn-23781.exe	127
PID 4360 wrote to memory of 4580	4360	Unicorn-23781.exe	127
PID 4140 wrote to memory of 4980	4140	Unicorn-59311.exe	126
PID 4140 wrote to memory of 4980	4140	Unicorn-59311.exe	126
PID 4140 wrote to memory of 4980	4140	Unicorn-59311.exe	126
PID 4108 wrote to memory of 1660	4108	Unicorn-51284.exe	128

C:\Users\Admin\AppData\Local\Temp\a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a5b4a4f3d130121332e117d2f626ba60_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65441.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37673.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        9⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        10⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        10⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        10⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe
        10⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        9⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        9⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6259.exe
        9⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        9⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        9⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        9⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        9⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        9⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
        9⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        8⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        9⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        9⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        9⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        9⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24365.exe
        8⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21791.exe
        8⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        7⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
        7⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        7⤵
        
        PID:18436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        8⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        9⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        9⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        9⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        9⤵
        
        PID:18692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        8⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30881.exe
        8⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        8⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43275.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        7⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        8⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        8⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1755.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
        8⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53044.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6879.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26286.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        7⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14071.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        7⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15503.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
        9⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58820.exe
        9⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        9⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
        9⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        8⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        8⤵
        
        PID:19184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        8⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        8⤵
        
        PID:18000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        7⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        8⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        8⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        8⤵
        
        PID:19400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        7⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        7⤵
        
        PID:19300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31524.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
        6⤵
        
        PID:17024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17024 -s 464
        7⤵
        Program crash
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
        6⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
        8⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        8⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6606.exe
        8⤵
        
        PID:17952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        7⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        6⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        7⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        6⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        6⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54601.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        7⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        6⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        6⤵
        
        PID:18700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        5⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        6⤵
        
        PID:17860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        6⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        6⤵
        Executes dropped EXE
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15681.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        9⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        9⤵
        
        PID:18548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        8⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        8⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        7⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37001.exe
        7⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4862.exe
        7⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        7⤵
        
        PID:17568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        7⤵
        
        PID:19176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27336.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        6⤵
        
        PID:18596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33270.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34071.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        7⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        7⤵
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        7⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        6⤵
        
        PID:18708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        6⤵
        
        PID:18636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        5⤵
        
        PID:3404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 464
        6⤵
        Program crash
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        5⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        5⤵
        
        PID:18040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
        5⤵
        
        PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        8⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        8⤵
        
        PID:18444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62912.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        7⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        7⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        6⤵
        
        PID:17420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        6⤵
        
        PID:19384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1695.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        6⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
        5⤵
        
        PID:18288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        5⤵
        
        PID:18576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5284
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 724
        5⤵
        Program crash
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        5⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        5⤵
        
        PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
      4⤵
      PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
        5⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe
        5⤵
        
        PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
      4⤵
      PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
      4⤵
      PID:13452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
      4⤵
      PID:17172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exe
        8⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        9⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        9⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        9⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
        9⤵
        
        PID:19196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33199.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        8⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21599.exe
        8⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51443.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13405.exe
        7⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        7⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        7⤵
        
        PID:18664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        6⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24937.exe
        8⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        8⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10452.exe
        8⤵
        
        PID:19380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21279.exe
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        6⤵
        
        PID:14244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        7⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59227.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        6⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        5⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        5⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        5⤵
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54601.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3776.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        8⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        8⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        7⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        7⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        7⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        7⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        5⤵
        
        PID:15188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
        5⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
        5⤵
        
        PID:18628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        6⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        7⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exe
        7⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
        6⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
        6⤵
        
        PID:18168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        6⤵
        
        PID:19352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        5⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        5⤵
        
        PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        5⤵
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
      4⤵
      PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
      4⤵
      PID:17116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        8⤵
        
        PID:18212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        8⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        7⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        7⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49676.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        6⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29741.exe
        6⤵
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        6⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        6⤵
        
        PID:18448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        5⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        5⤵
        
        PID:18144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        5⤵
        
        PID:19408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        6⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        6⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        5⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        6⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        6⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        5⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        5⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22533.exe
        5⤵
        
        PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        6⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        6⤵
        
        PID:18556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        5⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        5⤵
        
        PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5659.exe
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
      4⤵
      PID:13584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
      4⤵
      PID:17032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62924.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
        7⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        6⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        
        PID:18220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55398.exe
        6⤵
        
        PID:18508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41507.exe
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
        5⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        5⤵
        
        PID:18520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4862.exe
        5⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        5⤵
        
        PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
      4⤵
      PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
      4⤵
      PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
      4⤵
      PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
      4⤵
      PID:17440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36399.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        6⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        5⤵
        
        PID:16512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16512 -s 464
        6⤵
        Program crash
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
      4⤵
      PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
      4⤵
      PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
      4⤵
      PID:17060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
      4⤵
      PID:9268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
    3⤵
    PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
    3⤵
    PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
      4⤵
      PID:14200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      4⤵
      PID:17332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
      4⤵
      PID:19216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exe
    3⤵
    PID:6628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3399.exe
    3⤵
    PID:10372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
    3⤵
    PID:15604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
    3⤵
    PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
    3⤵
    PID:10828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        9⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        9⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        9⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        9⤵
        
        PID:18480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
        8⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        8⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
        8⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16191.exe
        7⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        7⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49137.exe
        9⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        9⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        9⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        8⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
        8⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        8⤵
        
        PID:18536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        8⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        8⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        7⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12646.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        7⤵
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exe
        7⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        8⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        8⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        8⤵
        
        PID:19388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        7⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24176.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        7⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
        6⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        7⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        7⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28570.exe
        7⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        6⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        6⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1695.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        7⤵
        
        PID:18108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        7⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14079.exe
        6⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47984.exe
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        6⤵
        
        PID:16932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        6⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        5⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        5⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24792.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
      4⤵
      Executes dropped EXE
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        7⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        7⤵
        
        PID:19436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14839.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        6⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        6⤵
        
        PID:19440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        6⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        5⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58855.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
        5⤵
        
        PID:17868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        6⤵
        
        PID:18788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44845.exe
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        6⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
        6⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        5⤵
        
        PID:17068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        5⤵
        
        PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
      4⤵
      PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        8⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        8⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
        7⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        6⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        7⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        7⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        6⤵
        
        PID:17976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
        7⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        7⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
        6⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        5⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        5⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        5⤵
        
        PID:18496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        7⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        7⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        7⤵
        
        PID:18952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18746.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        6⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        5⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exe
        6⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24102.exe
        6⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
        5⤵
        
        PID:12644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        5⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        6⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        5⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
        5⤵
        
        PID:17908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        5⤵
        
        PID:18312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        5⤵
        
        PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
      4⤵
      PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
      4⤵
      PID:15972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
        5⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        5⤵
        
        PID:18132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        5⤵
        
        PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
      4⤵
      PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        5⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        5⤵
        
        PID:19344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
      4⤵
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32038.exe
      4⤵
      PID:10984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
      4⤵
      PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        6⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        6⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12114.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28180.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exe
        5⤵
        
        PID:19284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
      4⤵
      PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
      4⤵
      PID:13296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
      4⤵
      PID:17624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8426.exe
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
    3⤵
    PID:7048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7048 -s 488
      4⤵
      Program crash
      PID:8616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32470.exe
    3⤵
    PID:10472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36795.exe
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
    3⤵
    PID:17896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        8⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48515.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        7⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        7⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
        7⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36698.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        6⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        6⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        7⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        7⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        6⤵
        
        PID:18804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        6⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15999.exe
        5⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        7⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
        6⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        5⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        5⤵
        
        PID:17888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23938.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        6⤵
        
        PID:17916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
        6⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        5⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        5⤵
        
        PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        5⤵
        
        PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
      4⤵
      PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9691.exe
      4⤵
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
      4⤵
      PID:16112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
      4⤵
      PID:8276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11648.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        7⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        7⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        7⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        7⤵
        
        PID:18660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        6⤵
        
        PID:18092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        6⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        5⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        5⤵
        
        PID:16868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        5⤵
        
        PID:18684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        5⤵
        
        PID:18160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        5⤵
        
        PID:18544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
      4⤵
      PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
        5⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        5⤵
        
        PID:17436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32038.exe
      4⤵
      PID:12076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
      4⤵
      PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        6⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
        6⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
        5⤵
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        5⤵
        
        PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      4⤵
      PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
      4⤵
      PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
      4⤵
      PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
      4⤵
      PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
      4⤵
      PID:8888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
    3⤵
    PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        5⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        5⤵
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
      4⤵
      PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
      4⤵
      PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
      4⤵
      PID:10952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
    3⤵
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34287.exe
      4⤵
      PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
      4⤵
      PID:9728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
    3⤵
    PID:9908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
    3⤵
    PID:11436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
    3⤵
    PID:15724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
    3⤵
    PID:4552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49889.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        6⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        6⤵
        
        PID:17412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64424.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        5⤵
        
        PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        5⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        6⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        6⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        6⤵
        
        PID:18460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        5⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
      4⤵
      PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
      4⤵
      PID:6428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7128.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        6⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        6⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exe
        5⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        5⤵
        
        PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
      4⤵
      PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
      4⤵
      PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
      4⤵
      PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20714.exe
      4⤵
      PID:8580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
    3⤵
    PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
      4⤵
      PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
      4⤵
      PID:10896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
    3⤵
    PID:7928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64851.exe
    3⤵
    PID:11252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
    3⤵
    PID:13732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
    3⤵
    PID:17152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
      4⤵
      PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        5⤵
        
        PID:18964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
      4⤵
      PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
      4⤵
      PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
      4⤵
      PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
    3⤵
    PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
      4⤵
      PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
      4⤵
      PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
      4⤵
      PID:10664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
    3⤵
    PID:8768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
    3⤵
    PID:12568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15999.exe
    3⤵
    PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
    3⤵
    PID:8692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26101.exe
    3⤵
    PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
      4⤵
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
      4⤵
      PID:15020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
      4⤵
      PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
      4⤵
      PID:19212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
    3⤵
    PID:8856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54927.exe
    3⤵
    PID:11636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
    3⤵
    PID:15212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
    3⤵
    PID:18116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
    3⤵
    PID:13092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
  2⤵
  PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
    3⤵
    PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
      4⤵
      PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
      4⤵
      PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
      4⤵
      PID:15880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
      4⤵
      PID:10740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
    3⤵
    PID:10080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
    3⤵
    PID:13000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
    3⤵
    PID:12320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29940.exe
    3⤵
    PID:18720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33362.exe
  2⤵
  PID:7764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
  2⤵
  PID:11124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
  2⤵
  PID:13804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
  2⤵
  PID:16984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3404,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5284 -ip 5284
1⤵
PID:6308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7048 -ip 7048
1⤵
PID:8576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3404 -ip 3404
1⤵
PID:9260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:7280

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1208 -ip 1208
1⤵
PID:10156

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:10224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11528.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
Size 184KB
SHA256 9192e4a64870cba3d1194889e74e32ba25df1eb8627e65d12742daf579296bd1
MD5 e25356d1406779cd19fcc2b90906504c
SHA1 6b4aaa79f044ccbcff77dc2347643e3a38977df7
SHA512 3d5ec2b45e0b99f71b538cd3c8055284a25a4fd7d7a1968d720823e8e924661e685b48129592c42f11fa3f1fc88b59959b2e568ea91e40eb9f4053ed0a82f8fe
SSDEEP 3072:gPqsJiop5nvsdPSfWW5NAVa1lvnq4Xiui:gPuo7YPSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-14564.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
Size 184KB
SHA256 2563ca2aeb16370463ccd3de68721fa64ebb50169db1b55f20f96372a7ac1b7c
MD5 cee2330e0bbafeeb117f4fcd4b5ce506
SHA1 51b488f657fc6c345f7d397a71c9c14941c2d582
SHA512 8bbdb0466b7aff6fd66c15128459e91739ee42eb0ac531ffbe464a10795182b6fa43bdc211e539da52c5b3d5ba4b4ef75ccc298d63ab010668cf7122d8c85588
SSDEEP 3072:gPqs2iop5nvsdPSfWW5NAVa1lvnq4Xiui:gPVo7YPSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16137.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
Size 184KB
SHA256 088031d3622b22292597713b822ab47a87bc43c769480055c6b79a2205cbb5c0
MD5 a4cd95a402b1fa2136d60bb1c4535525
SHA1 016c62add0ae271c3a7efcfc3249730710fcd4a8
SHA512 27522a72488f2f3ecab27baf335a7b6e2e64131843b431e6c671a1c9688ad7d4ad7bf538e20acd4eff921eda531f9d6e28f68be89fc6072e005084c1cb0e06c4
SSDEEP 3072:gPGsJiop5nvsdQSfWW5NAVa1lvnq4Xiui:gP6o7YQSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-18265.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
Size 184KB
SHA256 667bf388d4cb40245da0116ea9455ee7ee7d258ec3f6b2760f297b50b9107296
MD5 9d30b54c9fb49c64ffe1eae55349f881
SHA1 22915a20d2a05f42cf29545f1c372d94f1d5660c
SHA512 8e9b6a5f3312c61299127b41e8f0c2cd6521609b3484cff352d450b5dd478f8a8b43fe1e6daee1893798b17fb2c1c5b534ae72c174cb990238607702396ab2a1
SSDEEP 3072:gPGsJionenvsdQSfWW5NAVaClvnq4Xiui:gP6oaYQSfN0aClPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21350.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
Size 184KB
SHA256 b7302a7aa3ecf1dc0595a844fe437e179e4c0d7ea678965d19b759749b8ce944
MD5 4bc51773478c042781a1c012b023ff98
SHA1 51972471528782d3a4877ce2520d6005a2d1f435
SHA512 2defb6241eefdea93a16cfe56f42bdaaae12be9024739261c778492b30cc3c9bf3e42856ebd20ca1d2d7b2c4803fe32d866bc4883fa34905f29de59e14892b62
SSDEEP 3072:gPGsJiop5nvsdQSfWL5NAVa1lvnq4Xiui:gP6o7YQScN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23781.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
Size 184KB
SHA256 e0f3b0f7a8512ee01fdb16b2249ecc109ffc112efe62a30873d8366c868cdbb1
MD5 56a3608b1dbc709315b57f48e164c657
SHA1 bc955c00ece36ab0e27113ce61d0c560b7a94fb8
SHA512 708dda5af2690c6cee7d90143d50d772ae3adb51151df15ae206c5bb150e85b7a8971a8e1e8a239f1377d31d0f18cd1d80d3ae706fecbd3ed5b8fe15acc4a8b6
SSDEEP 3072:gPGsJiop5nvsdhSfWW5NAVaTlvnqWXiui:gP6o7YhSfN0aTlPqWXiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25229.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
Size 184KB
SHA256 47d56017f99483688c4585099f0f60d94a87bf8503ee23ff77f450285bbe3186
MD5 c65e6869362d8854ee0cacf9816c541a
SHA1 c55386558ca3375f189f4f452fef00ea245bd16a
SHA512 d407d33e2c756191074ddedd33683b48c5e418cfbbddeb53df689788a600909ac695eb46066974a1b2615d233a8ae1479d5aad27112cd071f4f5026b440c0994
SSDEEP 3072:gPGsJionKnvsdQifWW5NAVa9lvnq4Xiui:gP6oOYQifN0a9lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31647.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
Size 184KB
SHA256 f3abe9ee0aa76440b789ea270518039533e918a74536a5c928ed550168b84a8a
MD5 edccc90ca23b1b6792c6158e49c564a1
SHA1 8e2fd29097a3ddacfc8934fba2c2cc7e325a7682
SHA512 c5d48ea796590ea942cdc15d27611494f77c5974926244321a9976310eee54ff240ac44a0238bccdb583a8bdf4b4ca94bc7b3ef048baa7b475cd662e05f3d7e8
SSDEEP 3072:gPGsJion5nvsdQSfWW5NAVailvnq4Xiui:gP6oJYQSfN0ailPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3360.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
Size 184KB
SHA256 6d5e5e9148fcafff0c07a8f946f742280da16478d0e16937801e1490f7b71b57
MD5 74bd2ded7afe3ac9542bb6b8dac07746
SHA1 d770e8498113af44c9a12100398320d2d0ef23b8
SHA512 9dd24daf02da3f769fde69d2dfae81a4f1d7ae502670a4dffa58fbb40b85453023ae19b42d1ca3e7542a59a99a2e3c014b23f9c4a78013154f26b89ddb6b886d
SSDEEP 3072:gPGsJion5nvsdQSfWW5NAVaglvnq4XiuM:gP6oJYQSfN0aglPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-35363.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
Size 184KB
SHA256 8503dc8088214ac8638449e4851b769d31ff8f329dfb292cb4cf682891cec745
MD5 cd4e44a55f662d4a0a8baa75b75c28de
SHA1 8ff898fcb001e3bf3dedbeb48946cf00d2319267
SHA512 b44f91c7fbdf90f2b882c800c0e5372bcd82e6c28f5ed99b895985009b21ed962ec4012037f9707de2add718bada285c1764fe480ad301d802acc64cf9d845a5
SSDEEP 3072:8PGsJiop5nvsdQGfWW5NAVa1lvnq4Xiui:8P6o7YQGfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-35539.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
Size 184KB
SHA256 74f99fd0d2c8d537f03168fcea161de263773cb8209c3380337efec24870da70
MD5 59a0edc6f49b79ef9f0ec359774f0018
SHA1 47c71561f7a3c3d7fd1f7441fd162147f4a463eb
SHA512 85cfbacbe9bccdc47b8cdf89b42f9d1aa883c179aac13cbe581fe8a44df2437779c1bb11be82544c2f62c8fe39276b170cd59d6519f2b5b979942202efa0e394
SSDEEP 3072:gPGsJionKnvsdQSfWW5NAVazlvnq4Xiuo:gP6oOYQSfN0azlPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39069.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
Size 184KB
SHA256 806b74104a1aaf5cc0b68638d6c685657130cbf6f590eb5d9e8eb8c9db31e48d
MD5 551a39ee685559cd9097812e90a09d03
SHA1 cd4b74c70e2d68ed776ff038a3891e14d3b08261
SHA512 3f478430dd485b0d8c2532dff9202a0103c9cc43e50528c2b66915f12897d7a8f45dc8cc905b4015e421db781c1d9eb8b6e31a6242ef751fb211ac99e847d635
SSDEEP 3072:gPGsJionKnvsdQSfWW5NAVa9lvnq4Xiui:gP6oOYQSfN0a9lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39261.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
Size 184KB
SHA256 1c6c2e791c2faaaa15c2ddd8b4c713eebb3cecbf73f25263b66fc44927c253ec
MD5 d17da1ef6c37e2c1cbfd4dbf8dabca49
SHA1 734ea7f913ce682db57be606169831732a9783b5
SHA512 7ed6bdf0450b69183408a986f96b264fc8614abdbfca27a805895782573cf0bca3997953f5d6ce874c6cf6a5ed4b257ff7f2c6ab132020890b545bea2977eb4b
SSDEEP 3072:gPGsJion5nvsdQSfWW5NAVaclvnq4XiuM:gP6oJYQSfN0aclPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39468.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
Size 184KB
SHA256 6298b1e55bed311c12ef78c30e8adf888dec8be081540a1a7ef9781cacbf8920
MD5 349be27acfad749c4e1dbdba86e343d5
SHA1 6f9c288323bf03d2d7a55fc1cce2aacf9c6e6350
SHA512 eddfd0f719943b3d592b58504781c7c1a153895b8abe61f137ca6d20f724de619596594bffbeac3e0d7734d803c22a164604c4417762c34e759edae4052d3467
SSDEEP 3072:gPGsJion5nvsdQSfWW5NAVaClvnq4Xiui:gP6oJYQSfN0aClPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47429.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
Size 184KB
SHA256 cdcde0289c8db2f203910f8f6f46d25d9ac59f0e9c743698c6ac6de0723e25bb
MD5 3a02b582e839c03323558a5437b3f0cd
SHA1 5eb56de56566d37f2db44f76606f2502e69b0f59
SHA512 3f4d382a06a22b90402744403e30f9100d81fd56d49894095a0a093544c61d4d72f8c1dac5c74ebee719d388e329e53f91ff6f3bea1297112b35a07e3b479566
SSDEEP 3072:gPGs2ionKnvsdQSfWW5NAVaYlvnq4Xiui:gPZoOYQSfN0aYlPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49032.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
Size 184KB
SHA256 5491e64d7ce8907f7c846c4295c6800b6bfedad101ef567f1319bfdb304ebbd2
MD5 3e399a5b513f83606ccf2d4a8531fa27
SHA1 bfcb13180e34ffe2bd2bd43f678f6faac0fe219a
SHA512 c7fd9e56d9490858fa49305d520ccb8bd4e329242bddff5c8aa1b8b893782106ee7e6a32a355d95b46cce372bfe2983ec8afc0c1b889ea90f3b1b19f6bf9961d
SSDEEP 3072:gPGs2ionKnvsdQSfWW5NAVa1lvnq4Xiui:gPZoOYQSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51284.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
Size 184KB
SHA256 e9a1a7887a44d820a2fa80d064ee2fe68f9aefadc0face0fbb73e130c30cf806
MD5 37580a2e0510ae0fd36917c650f8ec1b
SHA1 e9e4193b6eb0901dfc8bbf47250284e552ace808
SHA512 62e9108d276574b06071605d90e3f8e40df12cd8903b321eafd92cdfc665c32fa201c4a9721f5368b0777b9496d52f6e17fd9db0a00c89dfbde36f12f1c28c22
SSDEEP 3072:gPGsJionKnvsdQSfWW5NAVa1lvnq4Xiui:gP6oOYQSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51513.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
Size 184KB
SHA256 c7d3721e06d2c478690e04068e001880dd46103ed0901f0483faf9551d5bef0c
MD5 90322e55aaa859de767b573bce52c38f
SHA1 c3ee644a0f370bba465f7989aa49bdd9d55f2a9a
SHA512 0d1fd6be12363d90dc2879217d7ea0bdddabca56da2b280052309b0269510ef8de54d07012d27412d173d48d8321eae59b6a11244026f86b090e9ab6e5a6d671
SSDEEP 3072:gPGsJiop5nvsdhSfWW5NAVaslvnqWXiui:gP6o7YhSfN0aslPqWXiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52561.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
Size 184KB
SHA256 ab1c8e642712ed12a3ed50cffa620f663a0dc8df5d70b180a08e948234ee3aab
MD5 b1c9aabb8bf5b6eadc8cc75f717e1bc8
SHA1 cddc538e294b9cf6a22d994a8bbfcc5226423738
SHA512 74949f929b7a127a99c2d233ea96bc41381f3b67066ab273c9c3bdc81cb580f97f1deb7458a4336685e34efa9ccb2653e6bf8915d92a69ab04676b5b1b1cef75
SSDEEP 3072:gPGsJionKnvsdQSfWW5NAVamlvnq4Xiui:gP6oOYQSfN0amlPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53551.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
Size 184KB
SHA256 f612a6cdd609294ddd36ae2bf173104aa76800f3797c4c3834f48a46dea04449
MD5 2d00b6d02db072a9ebb1aa45262e546d
SHA1 ee87b8ac736abcc8709d71b1ca2acf4f80d52c8a
SHA512 c072a39baee19ecfb9e126ba1fb653dae1d930d63be7efb6100a139028a7dcb06729500092e9c4887cd8fae7d24b29b8919464ee08f9cc0e0d03e9d8ae1cdc90
SSDEEP 3072:gPGsJionKnvsdQSfWW5NAVa5lvnq4Xiui:gP6oOYQSfN0a5lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54259.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
Size 184KB
SHA256 140c0b13587f45ea6c985bde9f7f68c2980b7e365ff65fb4cd1ef40cff9f9eec
MD5 fbfe312c77874799feaef7391b24e370
SHA1 608869f86fefeee3a10b043cbbdd09d1a4445bd3
SHA512 91114b035bb031be24716917dde6c3fb36e7ae56760c6471936bbcc5c59484d1d785965b45ba5be70127fe4c193c5d8c173f8b4b8415bd18a10c816c6de9a837
SSDEEP 3072:gPGsJion5nvsdQSfWW5NAVa9lvnq4Xiui:gP6oJYQSfN0a9lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57059.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
Size 184KB
SHA256 42afa2df9c0516c57ff7e761ed76b3dd622322caaf5de2e5e670cfbbb888a394
MD5 53206373edfb608e3154bd6157b1543d
SHA1 e30abec577ea3e76e245ca566b02187a14f07608
SHA512 0950cbdd45ebfd0fd54a7fac0fa0c4d7e34b5ae880b9bdf39e0d2c5586fa453ac72bf43433a3a0394426ccd32a38505e3ab4b354c1c9659a9e8d875366969aad
SSDEEP 3072:gPGsJiop5nvsdQSfWW5NAVallvnq4Xiui:gP6o7YQSfN0allPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57273.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
Size 184KB
SHA256 48a0b8512a8c745ab96fb9c2b28b1d07ce776ae00f1589948721f3d79945d9f2
MD5 03561e8df1fdec3527a88c8adba536dc
SHA1 c0ad0b48299a4544822f8ca3d0300efba721ad29
SHA512 f752b3f50ba5b482517d005cca5dc07423b03c88f65470ca951e23ca9fe2a71c82ee3e8a4c2efa94a11ed4b16aac4dde316f628fa0b06ac1b26adce788a51498
SSDEEP 3072:gPGsJionKnvsdQSfWW5NAVazlvnq4Xiui:gP6oOYQSfN0azlPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57828.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
Size 184KB
SHA256 2e5bf461b887cc1dfdd52746cf2bd6e64cadd0ca1fced000e1cbad413025dc51
MD5 13330b4bef84598f945c8f21cc627eec
SHA1 dbebf9a2019c7231314e31fe54b002e123020ca5
SHA512 567a409abb389f88d84a1ca29ffa6b1277aefbd9d321305f42dac13c066114a5b0ccc0c7b0aa8c4041dfa205a86be5d463de3750dc156e736ec883e64b550076
SSDEEP 3072:gPGsJiop5nvsdPSfWW5NAVa1lvnq4Xiui:gP6o7YPSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59311.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
Size 184KB
SHA256 0f9a28dca8dae197057379e7fe8289233635b6cc3ea14d00cb191a503dfb1cd8
MD5 fbbce31db56ca59ea7b3ef2369b32684
SHA1 748e5dcbb6c6e1e7ab13d6ce2e9b8338ffd6a2ca
SHA512 ceb61901450de92e9ab7c79496c6fc603c64a6195a36bfa189ee0b542bc2b89c83a5e5f589326e70370382ebfdffe5f6c8f812ef519db44d27648958532b5209
SSDEEP 3072:gPGsJion5nvsdQSfWW5NAVaglvnq4Xiui:gP6oJYQSfN0aglPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59747.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
Size 184KB
SHA256 a14efc693d5b2ee73794746c2d1ec0c6d419d11559b82cf59b2785e5b0f08082
MD5 9e9185720a9c3546a58a3b2239dd4264
SHA1 6012a9ba1480a9eba9b639b6a11e348b71b18bd6
SHA512 55bc940641f43eec528956e89a2c000b14edca126632b715e1f29d03dea7bb9d71d9c99de2ebb06a864e89c8b94bbb44f09ddc3ee50d44b52e9e87bd14553346
SSDEEP 3072:gPGsJionKnvsdQSfWW5NAVaplvnq4Xiui:gP6oOYQSfN0aplPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62924.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62924.exe
Size 184KB
SHA256 8c0f673b65628196a9fad4de35f1a966e5598b3d3a5689ab5958bf8f8a117a63
MD5 2a28880cf9fa34c4c9df7f999556e5e8
SHA1 fbd66cf07d41fea0770e7a5d4378337810cbba21
SHA512 b61c4a18a67fd5128105dfe608ae59c2e080de91f2acfdbdc4c71a5e303738715d9c02ed5ddf074c87b4b727ed4cee493ef6bcb9d2adbc88d1b7fbaa21644228
SSDEEP 3072:gPGsJioM5nvsdQSfWW5NAVa1lvnq4Xiui:gP6ocYQSfN0a1lPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62981.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
Size 184KB
SHA256 f51dd092aac316e7e8618a3796dfcfacfe847af47c2c0c9a78b2163c0f43f721
MD5 c62a5dfb0637acaccf1223ae1efe9516
SHA1 bb3f8f2aa62cca202892e446ebf8c7c994542a3d
SHA512 c9bf5897519b1a9e95b72a34d7105dfda97dbdf6b9645f55963ea627a292ed2317c86adb045f74ce3851c2bf3d3891b719548ca655bea66fdff1e5db9a24600b
SSDEEP 3072:gPGsJiop5nvsdQSfWW5NAVaTlvnq4Xiui:gP6o7YQSfN0aTlPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63189.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
Size 184KB
SHA256 452c79ee87c8c76be45f1b9575ff8f62ce927647ac07d20ecb3aa6dbecefda06
MD5 b0962bb215cc2c93fa7a853cf2cc3f88
SHA1 da4d05fa08b9309385965293263f287f640a0aad
SHA512 02be5c497ff7bcf28685f7f12ba016087e672cd1bc48fcf889dd133cf65dcc81f646afb307addb56e4046f7ad1f824b5232536103c8df32bbafcab7b126eb5b5
SSDEEP 3072:gPGsJiop5nvsdQSfWL5NAVamlvnq4Xiui:gP6o7YQScN0amlPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63936.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
Size 184KB
SHA256 1c8e1fb886166b3e3dfc75d81f07d6a47056c1264f3c6fb8dc2489c181bec09b
MD5 a1e34938ed0c323aad8b96104259a3bc
SHA1 c85a59f91a9b0ae307df4dca77c63f7756fcfcea
SHA512 e0ae5a18fc899d2cbb3b17d00ef90071fbb2e73757f3e63d5c743ea04cf3066736ced36eb3f05f4177714a6f0e9c184653500aa170ca11fa0fa35b6ef7815808
SSDEEP 3072:gPGsJiop5nvsdQSfWV5NAVaTlvnqWXiui:gP6o7YQSyN0aTlPqWXiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65441.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65441.exe
Size 184KB
SHA256 47dd16964d2a22e279c69a0a0acead824c36a6738425eba71635a929fd2cc09b
MD5 3c79095ab200dae21b89ac4c28d752bd
SHA1 e83effcb8669c62e604d51b0180805fcb37ac640
SHA512 107a77c1c3e3a2211d05e35e6b6eec462c391df7b0ec4d4834b0d208b8313977c6205128d6530e001f903aa017ade44d5bac628fe225bb57707cd247cb739b7a
SSDEEP 3072:gPGsJiop5nvsdQSfWW5NAVaTlvnqWXiui:gP6o7YQSfN0aTlPqWXiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6567.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
Size 184KB
SHA256 133e4fe0de4237d5dccd11cda2d5cca2e7fd411e79c12c9944fe3a4ef64954e5
MD5 71b525dcc4f99eaa03609f695be30c63
SHA1 fd212f1865127b290ee63286bb50372340adeaea
SHA512 2b14a81b208e2e089f23015fdf0ac385076ca258d453faa46a3230a5242ca17882ce7963284231c3fbd7bcbff26a64d873cbcd7e913fb7b717b33efa3329a97d
SSDEEP 3072:gPGsJiop5nvsdPSfWW5NAVaSlvnq4Xiui:gP6o7YPSfN0aSlPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7615.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7615.exe
Size 184KB
SHA256 9c1811bc6783076423fd2a31b78e78213c537c8dfae63fadcdbe52f102ad8794
MD5 cb36d7d0d0cd8a04a4d04a4bf68d9464
SHA1 7e564914569fb460cf665d452a955153db50eac6
SHA512 816278795307db3730c90fd86e829b504929b938adc5eabdaa0f7ab27389791ed323432399613a426865b254578f53deaf3e8eaf0fe4c1c4a06071bd0467a313
SSDEEP 3072:gPGsJiop5nvsdQSfWW5NAVaclvnq4Xiui:gP6o7YQSfN0aclPq4Xiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1924-3496-0x00007FF804910000-0x00007FF804B05000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads