e804adf6b54d467a0de819aa4d5edf54bbd94c27cd845465093f4e699049b53a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe
Size 184KB
Sample240603-tknefada57
SHA256 e804adf6b54d467a0de819aa4d5edf54bbd94c27cd845465093f4e699049b53a
MD5 c8e0e98f123b14da72c4be96f50a3e50
SHA1 8fff84e3f7b38007ed992578cc352bc10e5bb9ce
SHA512 fa92e6e52260d3a657c2fde6fbb12452c3c2e40fe857232b9a73f27b540baf74ea619c22355c4ea8b04261c96cde9c77defeb9f26f58bf94c5cc27763c0a54ab
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkLJvnqnpiuW:dGvoeeI2HzXkLJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3296	Unicorn-54277.exe
2664	Unicorn-36353.exe
4256	Unicorn-24655.exe
3108	Unicorn-51869.exe
4708	Unicorn-44448.exe
2500	Unicorn-64313.exe
3652	Unicorn-62267.exe
3048	Unicorn-53945.exe
4224	Unicorn-42247.exe
1076	Unicorn-29441.exe
388	Unicorn-43731.exe
3764	Unicorn-49861.exe
1464	Unicorn-54905.exe
1424	Unicorn-51376.exe
2756	Unicorn-5439.exe
1404	Unicorn-32321.exe
3692	Unicorn-28791.exe
2180	Unicorn-65185.exe
3176	Unicorn-9854.exe
4960	Unicorn-40681.exe
3288	Unicorn-28983.exe
2888	Unicorn-29389.exe
2436	Unicorn-33473.exe
212	Unicorn-41641.exe
4536	Unicorn-45725.exe
3104	Unicorn-49809.exe
4856	Unicorn-38303.exe
4908	Unicorn-42387.exe
2968	Unicorn-56123.exe
3356	Unicorn-535.exe
1808	Unicorn-38.exe
1100	Unicorn-18925.exe
5092	Unicorn-27839.exe
428	Unicorn-55873.exe
1756	Unicorn-63968.exe
2952	Unicorn-32329.exe
3724	Unicorn-36413.exe
5044	Unicorn-37159.exe
1892	Unicorn-59063.exe
1336	Unicorn-59063.exe
1620	Unicorn-53496.exe
2372	Unicorn-65001.exe
2912	Unicorn-16761.exe
2568	Unicorn-62432.exe
1536	Unicorn-41000.exe
4408	Unicorn-61877.exe
4996	Unicorn-12676.exe
2360	Unicorn-6546.exe
556	Unicorn-16953.exe
3404	Unicorn-37373.exe
1924	Unicorn-49817.exe
3964	Unicorn-49817.exe
3704	Unicorn-29951.exe
4736	Unicorn-62069.exe
4428	Unicorn-58540.exe
4320	Unicorn-6738.exe
1900	Unicorn-56448.exe
4556	Unicorn-7446.exe
756	Unicorn-1363.exe
5052	Unicorn-1363.exe
1832	Unicorn-8976.exe
4484	Unicorn-13807.exe
4528	Unicorn-62453.exe
3160	Unicorn-5084.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
5700	4320	WerFault.exe	151
7672	5948	WerFault.exe	197
7400	5616	WerFault.exe	208
10744	6832	WerFault.exe	247
11612	6832	WerFault.exe	247
17076	16764	WerFault.exe	861
3208	16820	WerFault.exe	864

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5428	dwm.exe
Token: SeChangeNotifyPrivilege	5428	dwm.exe
Token: 33	5428	dwm.exe
Token: SeIncBasePriorityPrivilege	5428	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe
3296	Unicorn-54277.exe
2664	Unicorn-36353.exe
4256	Unicorn-24655.exe
3108	Unicorn-51869.exe
4708	Unicorn-44448.exe
2500	Unicorn-64313.exe
3652	Unicorn-62267.exe
3048	Unicorn-53945.exe
4224	Unicorn-42247.exe
1076	Unicorn-29441.exe
1464	Unicorn-54905.exe
388	Unicorn-43731.exe
1424	Unicorn-51376.exe
3764	Unicorn-49861.exe
2756	Unicorn-5439.exe
1404	Unicorn-32321.exe
3692	Unicorn-28791.exe
2180	Unicorn-65185.exe
3176	Unicorn-9854.exe
3288	Unicorn-28983.exe
4960	Unicorn-40681.exe
212	Unicorn-41641.exe
4536	Unicorn-45725.exe
2436	Unicorn-33473.exe
4908	Unicorn-42387.exe
4856	Unicorn-38303.exe
3104	Unicorn-49809.exe
1808	Unicorn-38.exe
2968	Unicorn-56123.exe
3356	Unicorn-535.exe
2888	Unicorn-29389.exe
1100	Unicorn-18925.exe
5092	Unicorn-27839.exe
428	Unicorn-55873.exe
1756	Unicorn-63968.exe
2952	Unicorn-32329.exe
3724	Unicorn-36413.exe
5044	Unicorn-37159.exe
1892	Unicorn-59063.exe
1336	Unicorn-59063.exe
1620	Unicorn-53496.exe
2372	Unicorn-65001.exe
2568	Unicorn-62432.exe
1536	Unicorn-41000.exe
2912	Unicorn-16761.exe
4408	Unicorn-61877.exe
2360	Unicorn-6546.exe
556	Unicorn-16953.exe
3404	Unicorn-37373.exe
4996	Unicorn-12676.exe
3704	Unicorn-29951.exe
3964	Unicorn-49817.exe
1900	Unicorn-56448.exe
4736	Unicorn-62069.exe
4428	Unicorn-58540.exe
4556	Unicorn-7446.exe
4320	Unicorn-6738.exe
1924	Unicorn-49817.exe
756	Unicorn-1363.exe
5052	Unicorn-1363.exe
1832	Unicorn-8976.exe
112	Unicorn-63968.exe
4528	Unicorn-62453.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3296	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	93
PID 4992 wrote to memory of 3296	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	93
PID 4992 wrote to memory of 3296	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	93
PID 3296 wrote to memory of 2664	3296	Unicorn-54277.exe	95
PID 3296 wrote to memory of 2664	3296	Unicorn-54277.exe	95
PID 3296 wrote to memory of 2664	3296	Unicorn-54277.exe	95
PID 4992 wrote to memory of 4256	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	96
PID 4992 wrote to memory of 4256	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	96
PID 4992 wrote to memory of 4256	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	96
PID 2664 wrote to memory of 3108	2664	Unicorn-36353.exe	99
PID 2664 wrote to memory of 3108	2664	Unicorn-36353.exe	99
PID 2664 wrote to memory of 3108	2664	Unicorn-36353.exe	99
PID 3296 wrote to memory of 4708	3296	Unicorn-54277.exe	100
PID 3296 wrote to memory of 4708	3296	Unicorn-54277.exe	100
PID 3296 wrote to memory of 4708	3296	Unicorn-54277.exe	100
PID 4256 wrote to memory of 2500	4256	Unicorn-24655.exe	101
PID 4256 wrote to memory of 2500	4256	Unicorn-24655.exe	101
PID 4256 wrote to memory of 2500	4256	Unicorn-24655.exe	101
PID 4992 wrote to memory of 3652	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	102
PID 4992 wrote to memory of 3652	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	102
PID 4992 wrote to memory of 3652	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	102
PID 3108 wrote to memory of 3048	3108	Unicorn-51869.exe	103
PID 3108 wrote to memory of 3048	3108	Unicorn-51869.exe	103
PID 3108 wrote to memory of 3048	3108	Unicorn-51869.exe	103
PID 2664 wrote to memory of 4224	2664	Unicorn-36353.exe	104
PID 2664 wrote to memory of 4224	2664	Unicorn-36353.exe	104
PID 2664 wrote to memory of 4224	2664	Unicorn-36353.exe	104
PID 4708 wrote to memory of 1076	4708	Unicorn-44448.exe	105
PID 4708 wrote to memory of 1076	4708	Unicorn-44448.exe	105
PID 4708 wrote to memory of 1076	4708	Unicorn-44448.exe	105
PID 2500 wrote to memory of 3764	2500	Unicorn-64313.exe	106
PID 2500 wrote to memory of 3764	2500	Unicorn-64313.exe	106
PID 2500 wrote to memory of 3764	2500	Unicorn-64313.exe	106
PID 3296 wrote to memory of 388	3296	Unicorn-54277.exe	107
PID 3296 wrote to memory of 388	3296	Unicorn-54277.exe	107
PID 3296 wrote to memory of 388	3296	Unicorn-54277.exe	107
PID 3652 wrote to memory of 1464	3652	Unicorn-62267.exe	108
PID 3652 wrote to memory of 1464	3652	Unicorn-62267.exe	108
PID 3652 wrote to memory of 1464	3652	Unicorn-62267.exe	108
PID 4256 wrote to memory of 1424	4256	Unicorn-24655.exe	109
PID 4256 wrote to memory of 1424	4256	Unicorn-24655.exe	109
PID 4256 wrote to memory of 1424	4256	Unicorn-24655.exe	109
PID 4992 wrote to memory of 2756	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	110
PID 4992 wrote to memory of 2756	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	110
PID 4992 wrote to memory of 2756	4992	c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe	110
PID 3048 wrote to memory of 1404	3048	Unicorn-53945.exe	111
PID 3048 wrote to memory of 1404	3048	Unicorn-53945.exe	111
PID 3048 wrote to memory of 1404	3048	Unicorn-53945.exe	111
PID 3108 wrote to memory of 3692	3108	Unicorn-51869.exe	112
PID 3108 wrote to memory of 3692	3108	Unicorn-51869.exe	112
PID 3108 wrote to memory of 3692	3108	Unicorn-51869.exe	112
PID 4224 wrote to memory of 2180	4224	Unicorn-42247.exe	113
PID 4224 wrote to memory of 2180	4224	Unicorn-42247.exe	113
PID 4224 wrote to memory of 2180	4224	Unicorn-42247.exe	113
PID 2664 wrote to memory of 3176	2664	Unicorn-36353.exe	114
PID 2664 wrote to memory of 3176	2664	Unicorn-36353.exe	114
PID 2664 wrote to memory of 3176	2664	Unicorn-36353.exe	114
PID 1076 wrote to memory of 4960	1076	Unicorn-29441.exe	115
PID 1076 wrote to memory of 4960	1076	Unicorn-29441.exe	115
PID 1076 wrote to memory of 4960	1076	Unicorn-29441.exe	115
PID 4708 wrote to memory of 3288	4708	Unicorn-44448.exe	116
PID 4708 wrote to memory of 3288	4708	Unicorn-44448.exe	116
PID 4708 wrote to memory of 3288	4708	Unicorn-44448.exe	116
PID 1464 wrote to memory of 2888	1464	Unicorn-54905.exe	117

C:\Users\Admin\AppData\Local\Temp\c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c8e0e98f123b14da72c4be96f50a3e50_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32321.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        9⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        9⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        9⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        8⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40159.exe
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        8⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        8⤵
        
        PID:16764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16764 -s 248
        9⤵
        Program crash
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        8⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63221.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        9⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
        9⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        9⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        8⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
        8⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        8⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
        8⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        8⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        7⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        7⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        7⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        8⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        8⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        7⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
        7⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        6⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        6⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        6⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        9⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28395.exe
        9⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        9⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        9⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        9⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        8⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        8⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
        8⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        8⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        8⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        8⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        7⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        6⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        8⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45499.exe
        8⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        8⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        7⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        7⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20959.exe
        7⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        7⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34331.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        6⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        6⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        8⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49122.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9625.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        7⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        7⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        6⤵
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        7⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        7⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34509.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50193.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2586.exe
        5⤵
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46797.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        8⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        8⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15742.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        7⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2324.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        7⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        8⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        8⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        7⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        7⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        6⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26092.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        7⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        7⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        6⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        7⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe
        6⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        5⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        6⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        7⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        6⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23978.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        6⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        6⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        6⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-84.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-84.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        5⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        6⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        8⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        8⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        8⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        7⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        7⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49567.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50867.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
        6⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45499.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        7⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        6⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        6⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64354.exe
        6⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34331.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        5⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29687.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        7⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        7⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24556.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        6⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        6⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23312.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
      4⤵
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3896.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        7⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14327.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2271.exe
        5⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        5⤵
        
        PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        5⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        5⤵
        
        PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
      4⤵
      PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19066.exe
      4⤵
      PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        9⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        9⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        9⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        9⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        8⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        8⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        8⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44509.exe
        8⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        8⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        8⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        8⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-942.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        7⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        8⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        7⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        7⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        7⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31747.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        6⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        8⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        7⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        7⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        7⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe
        7⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        7⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        7⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38398.exe
        7⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19391.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60170.exe
        6⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
        7⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18047.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48920.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
        6⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        6⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        6⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        5⤵
        
        PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        8⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55936.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        8⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
        8⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        6⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42554.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60777.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        7⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        6⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46841.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
        5⤵
        
        PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48151.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        7⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60840.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        5⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        5⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        5⤵
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
      4⤵
      PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13436.exe
      4⤵
      PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      4⤵
      PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        8⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        7⤵
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        6⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        6⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51436.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        6⤵
        
        PID:16820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16820 -s 424
        7⤵
        Program crash
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        6⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        5⤵
        
        PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46311.exe
        5⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        5⤵
        
        PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        5⤵
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
      4⤵
      PID:12592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
      4⤵
      PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25711.exe
      4⤵
      PID:16484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31575.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        5⤵
        
        PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        5⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        5⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
      4⤵
      PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
      4⤵
      PID:14144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
      4⤵
      PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
      4⤵
      PID:17216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
      4⤵
      PID:7080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
      4⤵
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        6⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        6⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
      4⤵
      PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      4⤵
      PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
      4⤵
      PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
    3⤵
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      4⤵
      PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
      4⤵
      PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45038.exe
      4⤵
      PID:14188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
    3⤵
    PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
    3⤵
    PID:10928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
    3⤵
    PID:14372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
    3⤵
    PID:6520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        8⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        8⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        8⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        8⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        7⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
        7⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        6⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 632
        7⤵
        Program crash
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49331.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        6⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11104.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        8⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        8⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35080.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        7⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        7⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2271.exe
        6⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        6⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        5⤵
        
        PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18313.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19319.exe
        8⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        8⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        7⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16247.exe
        6⤵
        
        PID:16040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
        6⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        5⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        6⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        6⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        5⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        5⤵
        
        PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6546.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        7⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        7⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        7⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        5⤵
        
        PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        6⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
      4⤵
      PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
      4⤵
      PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      4⤵
      PID:12848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
      4⤵
      PID:16020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30933.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        7⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        7⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64892.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        6⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27730.exe
        7⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        6⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:16784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50475.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48114.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        5⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        5⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        5⤵
        
        PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exe
        6⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 484
        7⤵
        Program crash
        
        PID:10744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 492
        7⤵
        Program crash
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        6⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        5⤵
        
        PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-544.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        6⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        5⤵
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
      4⤵
      PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      4⤵
      PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
      4⤵
      PID:16800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
      4⤵
      PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59480.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34922.exe
        6⤵
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        6⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        6⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        5⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        5⤵
        
        PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exe
      4⤵
      PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8343.exe
      4⤵
      PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24064.exe
      4⤵
      PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24666.exe
      4⤵
      PID:17216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41000.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        5⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45196.exe
        6⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        6⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42707.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        5⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        5⤵
        
        PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
      4⤵
      PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
      4⤵
      PID:12772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2271.exe
      4⤵
      PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54685.exe
      4⤵
      PID:16704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
    3⤵
    PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
      4⤵
      PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        5⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7610.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59890.exe
        5⤵
        
        PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
      4⤵
      PID:9220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      4⤵
      PID:208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
    3⤵
    PID:8048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
    3⤵
    PID:9556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
    3⤵
    PID:13872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
    3⤵
    PID:16512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34691.exe
    3⤵
    PID:2936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36339.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1214.exe
        7⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32391.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        6⤵
        
        PID:16948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
        6⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
        5⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        5⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        5⤵
        
        PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        7⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        6⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-985.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2465.exe
        6⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33544.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7198.exe
        5⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        5⤵
        
        PID:14504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        6⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        5⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        5⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        5⤵
        
        PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe
      4⤵
      PID:12852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe
      4⤵
      PID:16232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
      4⤵
      PID:17076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
      4⤵
      PID:7616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57405.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exe
        6⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
        5⤵
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12500.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        6⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        6⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        5⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        5⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        5⤵
        
        PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16710.exe
      4⤵
      PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
      4⤵
      PID:8856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 640
      4⤵
      Program crash
      PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46127.exe
      4⤵
      PID:14316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
      4⤵
      PID:16968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
      4⤵
      PID:7308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
    3⤵
    PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
    3⤵
    PID:10616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
    3⤵
    PID:14160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
    3⤵
    PID:16804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
    3⤵
    PID:5364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5439.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        6⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6762.exe
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        5⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
        5⤵
        
        PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
      4⤵
      PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
        5⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        5⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
      4⤵
      PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
        5⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        5⤵
        
        PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
      4⤵
      PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52233.exe
      4⤵
      PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
      4⤵
      PID:16380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50075.exe
    3⤵
    PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
      4⤵
      PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        5⤵
        
        PID:16940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        5⤵
        
        PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
      4⤵
      PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46311.exe
      4⤵
      PID:15576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
      4⤵
      PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
    3⤵
    PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
      4⤵
      PID:10476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46863.exe
    3⤵
    PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
    3⤵
    PID:14084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19830.exe
    3⤵
    PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
    3⤵
    PID:17204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62069.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        5⤵
        
        PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        5⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
        5⤵
        
        PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe
      4⤵
      PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
    3⤵
    PID:5948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 636
      4⤵
      Program crash
      PID:7672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
    3⤵
    PID:8004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
    3⤵
    PID:9288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
    3⤵
    PID:13840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
    3⤵
    PID:15996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
    3⤵
    PID:7236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
    3⤵
    PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
        5⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        5⤵
        
        PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
      4⤵
      PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
      4⤵
      PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20959.exe
      4⤵
      PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
    3⤵
    PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
    3⤵
    PID:7588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53424.exe
    3⤵
    PID:13444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
    3⤵
    PID:15764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
    3⤵
    PID:5984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54733.exe
  2⤵
  PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
    3⤵
    PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
    3⤵
    PID:11144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
    3⤵
    PID:14268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
    3⤵
    PID:16744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
    3⤵
    PID:6492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
  2⤵
  PID:6828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
  2⤵
  PID:10684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27195.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27195.exe
  2⤵
  PID:14556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
  2⤵
  PID:9136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4320 -ip 4320
1⤵
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5948 -ip 5948
1⤵
PID:7372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5616 -ip 5616
1⤵
PID:8912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6832 -ip 6832
1⤵
PID:10132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6832 -ip 6832
1⤵
PID:11852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 16072 -ip 16072
1⤵
PID:3680

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-18925.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
Size 184KB
SHA256 de1c06700eab039285f34bec991c6c656c21f292d81dfacbaeaa72515642d7f6
MD5 758479659d3dde6ea9b245a310df4972
SHA1 6ccab36ddedd0789b993b29d01ca05ed1d1d39e6
SHA512 12bbc8e605cc086b048621e28b80f9ee33f761730e1d1c0ba8cd10e5782a98407a1091abf9d04be97b12f2be8dfa7f7927cd925a554b38ddd6716be20d47d278
SSDEEP 3072:dGNfZ3onpvxJydI2XsLAzsGk8JvnqnpiuW:dGvoReI2HzXk8JPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-24655.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
Size 184KB
SHA256 2a6f221e99a0cac6de48c260a06a562aa25a9662be3c6d68c8eea18ee07a66a7
MD5 463c21f74b96b6e9abdf0cbe7c7a813d
SHA1 9aa63231242c492060acfc017ab0c9f1009ceca0
SHA512 dbcc7d51100196e7eafe037142f1335bdc9042219f89defe6468989364b5ca508b30dbaa94efd772c9334f6d7532224eff3984f09626ec3ff2303c1d46c7ab35
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkNJvnqnpiuW:dGvoeeI2HzXkNJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28791.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
Size 184KB
SHA256 315538e65567b67546b83dea557695cabfd54a99705ff77168c98bc039524002
MD5 67e8dd8d188afc43056cfc82da473980
SHA1 f717d3b6806bf29629301ad964cde2d3ecf10c30
SHA512 f5d86ed8ec3ab64fd371a0174d9201ece16c8de7cb3d06d497af481ab7cd91c7fdb64e06c81fb1231f28b44a6cb0ad372a7723e408877dcb344b6576380a66d9
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGk8JvnqnpiuW:dGvoeeI2HzXk8JPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28983.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28983.exe
Size 184KB
SHA256 abff1a2cbfa66a21fee638081b2f162f97aabcf277a8cd54138d4e4224b39684
MD5 8fe7663239ee2c61f43e5dfc46a57c14
SHA1 d7256819408b8f947a0309a3fb8b8322325022f1
SHA512 f58f7cb01bd035d9dd6a26e846f945ffd1235ab09017742c5e84454eb0302ad7e9c6455d596caae26bd8ec49cefef63feec1478af7f004da6458861f2d71e402
SSDEEP 3072:dGkfZ3onpveJydI2XsLAzsGkuJvnqnpiuW:dGGoeeI2HzXkuJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29389.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
Size 184KB
SHA256 9f8d9e61e573c80d9e1eb7e6c0744e7da063d8f76983cfd3bfc1d69ec1a25f07
MD5 9cf10122356d4770a2d69e5d971c6fe2
SHA1 fccfc7fc57bb3d3a147aa5020f40f4f498b3cf80
SHA512 5165c93b8bf52e9984d258a0062d3d1f486fe1094aeae25d3482842a01ef686bc795060965e6c9f461bc9ebfcd03ef39dc3f02defac761e091e84eb944485897
SSDEEP 3072:dGNfZ3onpveJydI2XseAzsGkqJvnqnpiuW:dGvoeeI2gzXkqJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29441.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
Size 184KB
SHA256 86068ef319f5387065d109d14aafac1ec27f380836485d5fd2b443ea1dd0c5b6
MD5 111eb08394c0b5ae570b5130fc26163f
SHA1 1ab3a2624af7b14db56442e42f43e7ee27fe68d0
SHA512 efe16a2c957322b752c2f3b0daff5f553c995afce7fff3db24d2a229a5a21e4017b4a02957d7013f17f062fa29028736f3e864fe7528db5cf7855247b1710f58
SSDEEP 3072:dGkfZ3onpveJydI2XsBAzsGkZJvnqnpiuW:dGGoeeI2lzXkZJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32321.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32321.exe
Size 184KB
SHA256 f96d9e359dde45758d241b093649ad3defacbed4b9717a050e57b3907e4049c5
MD5 1dd6b151c11149009e5c91f07fd93323
SHA1 4e280543f72e086c408ed12668f577c92d83c1b4
SHA512 794544a3953100c4c82e4c07dd1ebf0a73a4b4f79019c708aed77edf2ae99581db929c89bef77195f11ff52872c14870275a1d174c70b4087bd084c47a377778
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsmkyJvnqnpiuW:dGvoeeI2Hz3kyJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33473.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
Size 184KB
SHA256 787b31e90d4f489c20d3ed0bfca1673c07c0e20c329a35de33b56fc23c15b14b
MD5 05e01dde2c90bd17e12c072b51395019
SHA1 23ad209344079d170b9c2bc0a4a3d58a7f0151c2
SHA512 a3aa485603b2d2d2c5b83f8c833034aff010ae7d16600093c0343bc34d1e0369ed5f3ef41bddd866a026c5234d2af99c3dcd6673eb7262caae0e1f3a0c871414
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzshkCJvnqnpiuW:dGvoeeI2HzAkCJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36353.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe
Size 184KB
SHA256 d3063d48d80b832aa9684d712d5077b17742cfb3e40fd9eb700ae4e0ef935991
MD5 2000423ab4bb3a45e7674503492e5264
SHA1 f01ac33f23a34d896cda4a744fe6b8c53a8f2358
SHA512 84166ad9f84e32ffdf2bae5809948bac7993251603ae7d703f892f3b29b275e5de239eb0d41eec51f7cd3556581f4880894248a949c30c047b2348892b7f34e6
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkrJvnqnpiuW:dGvoeeI2HzXkrJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
Size 184KB
SHA256 f18260bd231c09565020c308a122da7b852be773c9b80434ab37bd3c7c1a844e
MD5 50b787ddbba2258baadc3cefe6602e52
SHA1 5a2d4c92b5c9b842440750044cfc11934e600acf
SHA512 6ec3b57945adb9160e5b4e85a3b484249d87ce303d6528d22cd26b18cfa5f440dfae1a2a6bc3dc4664277646f31a2ee139299885d4291a35300a76939fdc4387
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkLJvnqnpiuW:dGvoeeI2HzXkLJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38303.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
Size 184KB
SHA256 c86ee45b75ddf0700a117834764a0e076b34fb99e283685abf537908aa8d8673
MD5 365b2e1bc4e0c7a9204bc0678f438eb6
SHA1 1e5fde551008da1747aad22c8a2ad19c0f5ba626
SHA512 52b6e39fec563114f8691831d679b5fa53405d4601e000c5924c5ef3543cad092cc547ad0e734add07cb1598bcb71266f2d091d2346d46328d556d8f7ae58ff3
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkKJvnqnpiuI:dGvoeeI2HzXkKJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40425.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40425.exe
Size 184KB
SHA256 1b29f18bae24c516cdabe9672ddeda4edc8eaaf6a7592b6ee097a3b06720d877
MD5 54b957d02bb34316b35e8bce4e60eb08
SHA1 2d8a9171d8e11eaf8d29448634f2646d714a68c7
SHA512 9565c527280bc67a6c4d9cd7a1bc787c5a3801a8472af86e7b18082434651a9262dcd0c14a8bd2e288c030d6c1ce58b6923e3224eabb7d427c3aac5d5549ca64
SSDEEP 3072:xGNfZ3onpveJydI2XseAzsGkXJvnqnpiuW:xGvoeeI2gzXkXJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40681.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
Size 184KB
SHA256 2329b7cd03d2353b872769560e2fd2404b4f3c42dad606c29ad57b939c883594
MD5 60c36609653ae0013de2cce258853153
SHA1 0d28113b6c01085c3d5c67b2e8356f9886d08fc8
SHA512 dd872d22361c43c6dbe59a13ab647d8846df92d14ef1d28d7fdde16a99a8075f371b9ebf166a6e9ea8d2f05bb6cdd9eef6398f905250d8c8d4b10ccd97a4cf96
SSDEEP 3072:dGkfZ3onpveJydI2XsBAzsGkfJvnqnpiuW:dGGoeeI2lzXkfJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41641.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
Size 184KB
SHA256 5205fd5243dc15001849365191f2ccfc2e6eb1fdab1657fe75c37c4cc4d9f4a7
MD5 073c53401961ed38f7e67b7abfd6dfc6
SHA1 8e89f7945cc62f365151a725c7d7e0960db60dd3
SHA512 a3bb08efb14b2604e7a75c3509c4ed16037e8643bcffdb873d155d38d663e173aa52c1c470496b69565f84244834111f7497932ce8223fb1102e8180251d40b6
SSDEEP 3072:dGNfZ3onpOeJydI2XsLAzsGkUJvnqnpiuW:dGvoHeI2HzXkUJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42247.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe
Size 184KB
SHA256 18d87d683b22882c506ae3882743c7c73264ac9fe5aabbc70b64589f7a6f9b18
MD5 5fae03322fd7ea01513cfe40e76cd44f
SHA1 45a4ba38cfdbe3b4807e2f0efd7d623e97f8a4a9
SHA512 6c1e380301a785cf2df80a9cf4ee67df2bd34b306152bc9d97d8f1cd6136f42925a6cf68c5d4b26b35e4f4cf84358d07531c40218ffb717afebbc70d4a062862
SSDEEP 3072:dnNfZ3onpveJydI2XsLAzsGkrJvnqnpiuW:dnvoeeI2HzXkrJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42387.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe
Size 184KB
SHA256 e21b5b61c16412c72894fb448ad631444734d0bfea2c259ad7939ef0b7e07113
MD5 d7610a8a1f7e5254c1cdc3d3f94a3ced
SHA1 73ed5c4c9c1c1b2ed1015a0e4bde34f6f7f9c3b1
SHA512 7a4d8fb2d8ea0dbe6ce78a62f64616fafd4f050a5eb94f58042b39775384ee0cd2f56e888f6cacd82911f40735013185834f10f4f52fd4f86586216812f18466
SSDEEP 3072:dXNfZ3onpveJydI2XsLAzsGkkJvnqnpiuW:dXvoeeI2HzXkkJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43731.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
Size 184KB
SHA256 2ccfafe0fbd03a0ec925c8e06121ed0468c0bc3cc6ad50d3a7062d8a9cc47f92
MD5 0ae74141ad419a45d7f8524b0d826493
SHA1 e3e2dafff40ab04b6f98e47f12496613be6b5176
SHA512 493da2dd60457547d989c6fd01615704fcd4f7db2a184963a63a5484a188d04b09dce071750144a2e18b736b07bd54eafde018977cb313fda7c9b5334a8b0826
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGknJvnqnpiuW:dGvoeeI2HzXknJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44448.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
Size 184KB
SHA256 3259bab7e4aaeca81edb354a2fba2ffc6036ff9fc7038c851f70059d37053d3b
MD5 918f2c6bfed5df6696b6510ee5205ac4
SHA1 462a97bc0e97101d8d2aff7b784feab4e09a25f2
SHA512 9519c2e9088bf05a2f0f4ca0e06f6db9a36109e904113b4247bc754ad9a91c9d62dec915bc19155398f9019622e105355813c24d64db90d6330b7599616854aa
SSDEEP 3072:dGkfZ3onpveJydI2XsLAzsGkZJvnqnpiuW:dGGoeeI2HzXkZJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45725.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
Size 184KB
SHA256 21615a20ac05704d34c96d694d42e8707618830bfd41d9f2d72c84bdf33b5892
MD5 b7f3372f66dcb01379ee922195a4fddd
SHA1 a4fda7e7b1c456a046268145bd55778bf159cefd
SHA512 61a958498c90a1858479e7bed858226c5e3e987cf1fb57b42f0b6751ed4d7a2db297ba750acc5db888a7a1499c7fd93e61f3c5cae55f6aaeedaa7264e495c4d2
SSDEEP 3072:dGNfZ3onpveJydS2XsLAzsGkbJvnqnpiuW:dGvoeeS2HzXkbJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46413.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46413.exe
Size 184KB
SHA256 799305ef78a462ee70a425e4cc5f0dcc058af6ba701054dd43b2de6bf12244df
MD5 ab363eed6b7fdd04f1526618be0fa5a9
SHA1 61cd0db83d2f5147d1ac2c95bf445bb419bb6712
SHA512 bc7c2e10c42bbe0daec95585be166b484fbd8b7f538e69c481cb8cef40288cd1fd363c95073c52219236f18211003df3975a375655b437f0eaeb38ebd121617a
SSDEEP 3072:HGNfZ3onpveJydI2XsLAzsGkkJvnqnpiuW:HGvoeeI2HzXkkJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49809.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
Size 184KB
SHA256 b1477380a58b280cd17cddac4fec1ed86bcccf6d56463bbd9f0b90da0657f5be
MD5 734773d7d7b653b335b2ba50e5c4389b
SHA1 40b759d7a8b81a7321ea546aa95feac4e661bc4e
SHA512 396e73d6543afa1ef0fdc79289ab2cedf66842d459bf6a616a1e95cf792aec5824986144a30f30e94c624b1a44d157caee11c2dc390d06ef857e1d47344a5760
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkSJvnqnpiuW:dGvoeeI2HzXkSJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49861.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
Size 184KB
SHA256 50ef6117148905baa630ce838071b87005569ea808df11b6121aff0a7d129a41
MD5 a719d52dc27fb020389bb504863bc197
SHA1 08b6b348757b5816b3e12ee539b729dcee08e7ed
SHA512 fa59e33e95805c16e7f41b83882fddd92e38ec266c24f8c9f65149c066916d666dc842843d81aad471e987d770c48a3948c89a9ff01c2b9271187ee8ada2b901
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkCJvnqnpiuW:dGvoeeI2HzXkCJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51376.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
Size 184KB
SHA256 4071456c0e73aa09b4718dfeb13f79891ffe7e48b6f8c7ed4009d2e27710500a
MD5 fc3a1b1fe768aa9433e9a2f5d2975f6f
SHA1 01b4cb8103a083ffe38ca5110d3cb2c0688e43ac
SHA512 b1b5ce019b7c94703f2e28811b61599d559f60bd1fac520d84f2daedfd50118b2ca38aa178377847abca378c7e55555b6bdddc9b1857613b4a10a456db01b7d6
SSDEEP 3072:dGNfZ3onpOeJydI2XsLAzsGkNJvnqnpiuW:dGvoHeI2HzXkNJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51869.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
Size 184KB
SHA256 3f9897036cce9dcdde8edf4bb96570815647400b34d3032d8d30750144874b6a
MD5 4246e642b6c0117b920b8629e74a0f95
SHA1 38a8d7816f395bb64e4c56c360a2d2e822a6f6b7
SHA512 2ffad6341e36d2e320739055814e3d856b59072a77922a3b99a2c4fe82105517aebe5a56463583fd0ecb9436b3cf8d08aa311b47edbb0a32a35b3e1d03309970
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkLJvnqnpiuW:dGvoeeI2HzXkLJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-535.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
Size 184KB
SHA256 ad993858f9e421a435472f3431df13c74193f26e8c4dff5ae0485f6d6c5e4dca
MD5 45ff8579f7a0cc27bb1a5bcb72ac1ac7
SHA1 0d82146301269298b91578d213e84354b19c0623
SHA512 14a60bb28d36bc99cf825dad5cfea884ed88eca43854239d332626396a7bdd48cf1c34600b38fa96714491150ea612d8a7b80dc25c5d14fd0c06de767003452b
SSDEEP 3072:dGNfZ3onpv4JydI2XsLAzsGkZJvnqnpiuW:dGvoQeI2HzXkZJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53945.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53945.exe
Size 184KB
SHA256 224fa796ec126ad7a25dc4983728f3e3e9e230d375d86158425a09048cae5efb
MD5 fc16472a2d91eeef7f2871c401e9a716
SHA1 3bef2f1800b740491325db5f09d0b70b39aa4f7b
SHA512 03b37f87e49261bbd66930f323cacbb75f3345483fe6ed0163c8010a25be31ae6f171c737ac42f62c034b7558941c963d0fcd2ee5cbaff772d917a265daa987c
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkyJvnqnpiuW:dGvoeeI2HzXkyJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54277.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
Size 184KB
SHA256 2f488631ae4571bdc4fe378a8fa936adfff303ec9ec49d4bc065b43775d547df
MD5 a3cee72707190ec5e3a602deae3443e1
SHA1 67d495219a179cc9fbc2eebedaee88614d93e33b
SHA512 c77fda1ca4d45bcbd99a9a5c4fd9b614d3ef8a590c1ad0a95312e54d18c854e88365297b42c3eb2e45b7410428c8ff37137535f38bb10cb54a99c59f87398b93
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkZJvnqnpiuW:dGvoeeI2HzXkZJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5439.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5439.exe
Size 184KB
SHA256 b6edcf850d11d5e55c6ccbd2b4bdae7716b8de8957aa9f49c681f443ae3d3e99
MD5 e0b47785542d823eb8e493a4aa67571a
SHA1 12965a97a97e12a9ca8ca4a0fe6f8a1c1d80d6bd
SHA512 e79747f17c16898e0cb804534b95dfdffd52481fa5fc340c74e70ebdfb41e3a9b44176e0f3331866fcfdc081127dd9c193254e0d38e1176b3cea17584b0b00ed
SSDEEP 3072:dGNfZ3onpveJydS2XsLAzsGkLJvnqnpiuW:dGvoeeS2HzXkLJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54905.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
Size 184KB
SHA256 e7bde5a581496fd0e6e16dcc4ee80dd9b13d8a56cb5249abd36d9c32ad5f5a00
MD5 5da43a7cf1fc1c6a50c2e85f5eea4b43
SHA1 99bcb6ae2516a6e16a5230fa67ac208a1a50b345
SHA512 fdf269231e537d29095a1870f4fc6feaf0ceb06da958030dabf68df8283e94e3485e236e2ce9a0bfacb3f938fbd48b7f37697855a3d7d03ac557130812d8a928
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkqJvnqnpiuW:dGvoeeI2HzXkqJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56123.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
Size 184KB
SHA256 b2cdf65f76978423e7123b769b5de64fe7f36dadcbfceecdfbd0a6ea2816c910
MD5 dbca96bae092e23ea32e4a2a002c77ec
SHA1 715b3fa4c34a325eca8520b194633289bd2da911
SHA512 cb01f150e564fdf98a86eec574770390f4b0ac7cda5f238238720ec5c93793327939cf38aa3385f1a56559406a498d3a5a2c6d441e0f92c284ed3811c10baa6a
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkEJvnqnpiuW:dGvoeeI2HzXkEJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62267.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
Size 184KB
SHA256 a27ba7566350918cdb13d4de6481ecd468887954a82a9d4cfdeea994089b3233
MD5 5f563ebc7de646544d81993441d3dfd9
SHA1 dcdc175789550fdb21dc20dad277fe21e0dc7bd4
SHA512 c304bf3df58b6d2f824ce05d8e7bd2213037e637f725cab27029e320ec26f63932dbfbbd7bbd9e2249ce94412928beb44ad7ddb1f3c9be1836b15b63c69db263
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkKJvnqnpiuW:dGvoeeI2HzXkKJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-64313.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
Size 184KB
SHA256 671231c61e13a59d84c222bf31d6ae974e0740e6474613e250d800c95b5ab72c
MD5 51fcec981eceaacbb1c61b79a4d3825a
SHA1 bb767a6c8e870ece76fc96ba73bd0d78778c714f
SHA512 6e6894c0876ebd798c1b2a85e6e031638fbfd8bbf20210fedd0d7034deae8de51f4223d705ef0a1dcbbb899ec259bf863aaa835ba5ca5fe396395bc70f45d822
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkkJvnqnpiuW:dGvoeeI2HzXkkJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65185.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
Size 184KB
SHA256 5bf1699112fec69480043918875fb59e725c45204865f329db6ee533486ed4a0
MD5 7fea8174f9fe05a21184ba2d8b08a8db
SHA1 081bb42d6f73f79fafceb04e67b3837de1ab0bad
SHA512 f010d5a64a117da225373922d8c1f837850e37036dac11ec900ca6e91bf0fcefcf46e05ad56b5aa00386c8bbadc28c41daf4a083664099834314385e2098c724
SSDEEP 3072:dnNfZ3onpveJydI2XsLAzsGkrJvuqnpiuW:dnvoeeI2HzXkrJmqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9854.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
Size 184KB
SHA256 b1f116fc35cb940275f65c3d6907d672fb9ab30364fb348061d0d4b6f48d66d7
MD5 78e9456c5d0b414dce6d69e38bafd5f7
SHA1 4419a76413fed5002a61b26259db1231958bf663
SHA512 774ed06cab6b36a842f9cb77b8680dec760711e64909ea931a4b4e4ae0bdf999ee33f5bb64127ef20bcafdbc456dcfbfb3650c8700cc76bc6c7e55c4cbe3b5c6
SSDEEP 3072:dGNfZ3onpveJydI2XsLAzsGkrJvnqnpiuq:dGvoeeI2HzXkrJPqnpiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-187-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/388-82-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/396-396-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/428-236-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/556-312-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/756-376-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1036-389-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1076-70-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1092-414-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1100-226-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1404-112-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1424-96-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1464-86-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1536-286-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1620-265-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1636-3801-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1756-241-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1808-199-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1832-378-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1892-264-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1900-341-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1924-322-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1964-420-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2080-412-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2140-415-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2180-126-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2360-311-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2372-276-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2436-167-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2500-42-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2568-283-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2664-13-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2756-97-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2888-161-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2912-280-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2952-248-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2968-195-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3048-57-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3104-191-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3108-27-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3160-385-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3176-133-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3288-145-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3296-7-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3356-196-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3404-317-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3652-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3692-119-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3704-338-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3724-250-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3764-84-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4224-63-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4256-20-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4320-739-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4320-337-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4408-300-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4428-336-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4484-379-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4528-380-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4536-189-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4556-340-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4612-387-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4708-41-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4736-339-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4844-431-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4856-193-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4908-194-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4960-143-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4992-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4996-310-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5052-377-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5092-231-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5124-435-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5144-436-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5156-437-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5168-438-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5260-464-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5276-465-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5296-466-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5340-483-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5368-485-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5396-486-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5472-488-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5480-487-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5564-492-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5624-501-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5664-505-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5740-756-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5760-757-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5776-758-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5800-759-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5816-762-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5832-763-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5864-764-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5880-765-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5896-766-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5920-767-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/6540-3707-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/7684-3574-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/13772-4749-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/15532-4637-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/15580-3471-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/15652-3590-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/16780-3476-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/16784-3172-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/16844-3152-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads