7e10b5178a79724c042cce7c8b016b3ea4b4df4f6c36ba0adb6d395908a3af03

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe
Size 184KB
Sample240613-mq9fjayhrp
SHA256 7e10b5178a79724c042cce7c8b016b3ea4b4df4f6c36ba0adb6d395908a3af03
MD5 755f34ff37b113791105cc5879264d50
SHA1 a669a962393e6f06caf063b3611f0bd51b0a14ad
SHA512 4ddb3e0eefb3d62d90186ce715de1b1a63c11ec1b769c0391cd28efb958312942c715860875497efbec037b8400ea3330a6afde31a05c358a92ce73b1c4112c9
SSDEEP 3072:hUukavoR3NQUrj0PX9rj6WZ6LvMqnviuF:hUIo4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3312	Unicorn-1828.exe
3340	Unicorn-45684.exe
4456	Unicorn-12.exe
2328	Unicorn-14376.exe
3732	Unicorn-20498.exe
2704	Unicorn-43711.exe
540	Unicorn-42493.exe
2364	Unicorn-6291.exe
2392	Unicorn-26157.exe
1636	Unicorn-30241.exe
3044	Unicorn-29976.exe
2116	Unicorn-11666.exe
4380	Unicorn-65025.exe
5072	Unicorn-28631.exe
4888	Unicorn-56665.exe
1416	Unicorn-3380.exe
1148	Unicorn-46259.exe
2264	Unicorn-48305.exe
4704	Unicorn-32523.exe
672	Unicorn-27122.exe
3748	Unicorn-31969.exe
3720	Unicorn-31969.exe
1600	Unicorn-16711.exe
2716	Unicorn-62648.exe
2228	Unicorn-63053.exe
1004	Unicorn-39103.exe
2520	Unicorn-38357.exe
1844	Unicorn-13150.exe
3840	Unicorn-35233.exe
4652	Unicorn-64376.exe
3640	Unicorn-2368.exe
4980	Unicorn-35595.exe
1804	Unicorn-35041.exe
3992	Unicorn-57516.exe
3464	Unicorn-48793.exe
4912	Unicorn-61045.exe
1480	Unicorn-31495.exe
2960	Unicorn-32265.exe
3052	Unicorn-44517.exe
2992	Unicorn-19747.exe
1280	Unicorn-61600.exe
4536	Unicorn-56007.exe
936	Unicorn-11652.exe
4948	Unicorn-57324.exe
1816	Unicorn-9798.exe
3864	Unicorn-24097.exe
1212	Unicorn-46555.exe
1544	Unicorn-41969.exe
224	Unicorn-17465.exe
2820	Unicorn-5767.exe
1008	Unicorn-64427.exe
3788	Unicorn-50137.exe
4204	Unicorn-38439.exe
4388	Unicorn-33609.exe
1332	Unicorn-41512.exe
4136	Unicorn-14842.exe
2736	Unicorn-59265.exe
2560	Unicorn-6535.exe
2332	Unicorn-18403.exe
2224	Unicorn-58881.exe
4980	Unicorn-46437.exe
4708	Unicorn-38269.exe
5028	Unicorn-31946.exe
2192	Unicorn-33993.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4604	4456	WerFault.exe	96
2332	4456	WerFault.exe	96
7936	5628	WerFault.exe	213
11288	7056	WerFault.exe	266
17212	16692	WerFault.exe	809
17492	18164	WerFault.exe	898
3048	18088	WerFault.exe	892
992	6756	WerFault.exe	286

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
14948	svchost.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
20408	Process not Found
20448	Process not Found
20460	Process not Found
5864	Process not Found
9816	Process not Found
20188	Process not Found
9872	Process not Found
9976	Process not Found
20216	Process not Found
9356	Process not Found
2220	Process not Found
1440	Process not Found
4996	Process not Found
6804	Process not Found
17924	Process not Found
2216	Process not Found
10108	Process not Found
10100	Process not Found
9448	Process not Found
11580	Process not Found
11620	Process not Found
11628	Process not Found
11664	Process not Found
18708	Process not Found
11780	Process not Found
9456	Process not Found
11840	Process not Found
2904	Process not Found
9544	Process not Found
18936	Process not Found
10144	Process not Found
9512	Process not Found
552	Process not Found
10116	Process not Found
11972	Process not Found
12040	Process not Found
9644	Process not Found
12064	Process not Found
9492	Process not Found
12008	Process not Found
19744	Process not Found
9860	Process not Found
12072	Process not Found
12016	Process not Found
10332	Process not Found
9636	Process not Found
10308	Process not Found
12028	Process not Found
10364	Process not Found
12036	Process not Found
10324	Process not Found
10344	Process not Found
17704	Process not Found
12188	Process not Found
10484	Process not Found
10612	Process not Found
12124	Process not Found
10736	Process not Found
12164	Process not Found
12264	Process not Found
10824	Process not Found
12228	Process not Found
9472	Process not Found
10812	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5920	dwm.exe
Token: SeChangeNotifyPrivilege	5920	dwm.exe
Token: 33	5920	dwm.exe
Token: SeIncBasePriorityPrivilege	5920	dwm.exe
Token: SeCreateGlobalPrivilege	20436	Process not Found
Token: SeChangeNotifyPrivilege	20436	Process not Found
Token: 33	20436	Process not Found
Token: SeIncBasePriorityPrivilege	20436	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe
3312	Unicorn-1828.exe
3340	Unicorn-45684.exe
4456	Unicorn-12.exe
2328	Unicorn-14376.exe
3732	Unicorn-20498.exe
2704	Unicorn-43711.exe
540	Unicorn-42493.exe
2364	Unicorn-6291.exe
2392	Unicorn-26157.exe
3044	Unicorn-29976.exe
2116	Unicorn-11666.exe
1636	Unicorn-30241.exe
4380	Unicorn-65025.exe
5072	Unicorn-28631.exe
1416	Unicorn-3380.exe
4888	Unicorn-56665.exe
3748	Unicorn-31969.exe
1148	Unicorn-46259.exe
2264	Unicorn-48305.exe
4704	Unicorn-32523.exe
672	Unicorn-27122.exe
3720	Unicorn-31969.exe
1600	Unicorn-16711.exe
2716	Unicorn-62648.exe
2228	Unicorn-63053.exe
1004	Unicorn-39103.exe
2520	Unicorn-38357.exe
1844	Unicorn-13150.exe
3840	Unicorn-35233.exe
4652	Unicorn-64376.exe
3640	Unicorn-2368.exe
1804	Unicorn-35041.exe
3992	Unicorn-57516.exe
1480	Unicorn-31495.exe
4912	Unicorn-61045.exe
3464	Unicorn-48793.exe
2960	Unicorn-32265.exe
936	Unicorn-11652.exe
2992	Unicorn-19747.exe
3052	Unicorn-44517.exe
1280	Unicorn-61600.exe
1816	Unicorn-9798.exe
4536	Unicorn-56007.exe
4948	Unicorn-57324.exe
3864	Unicorn-24097.exe
1212	Unicorn-46555.exe
1544	Unicorn-41969.exe
2820	Unicorn-5767.exe
1008	Unicorn-64427.exe
224	Unicorn-17465.exe
3788	Unicorn-50137.exe
4388	Unicorn-33609.exe
1332	Unicorn-41512.exe
4204	Unicorn-38439.exe
4136	Unicorn-14842.exe
2736	Unicorn-59265.exe
2560	Unicorn-6535.exe
4980	Unicorn-46437.exe
2332	Unicorn-18403.exe
4708	Unicorn-38269.exe
2224	Unicorn-58881.exe
5028	Unicorn-31946.exe
1132	Unicorn-18211.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3312	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	93
PID 4844 wrote to memory of 3312	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	93
PID 4844 wrote to memory of 3312	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	93
PID 4844 wrote to memory of 3340	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	95
PID 4844 wrote to memory of 3340	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	95
PID 4844 wrote to memory of 3340	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	95
PID 3312 wrote to memory of 4456	3312	Unicorn-1828.exe	96
PID 3312 wrote to memory of 4456	3312	Unicorn-1828.exe	96
PID 3312 wrote to memory of 4456	3312	Unicorn-1828.exe	96
PID 3340 wrote to memory of 2328	3340	Unicorn-45684.exe	97
PID 3340 wrote to memory of 2328	3340	Unicorn-45684.exe	97
PID 3340 wrote to memory of 2328	3340	Unicorn-45684.exe	97
PID 4844 wrote to memory of 3732	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	98
PID 4844 wrote to memory of 3732	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	98
PID 4844 wrote to memory of 3732	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	98
PID 3312 wrote to memory of 2704	3312	Unicorn-1828.exe	100
PID 3312 wrote to memory of 2704	3312	Unicorn-1828.exe	100
PID 3312 wrote to memory of 2704	3312	Unicorn-1828.exe	100
PID 2328 wrote to memory of 540	2328	Unicorn-14376.exe	106
PID 2328 wrote to memory of 540	2328	Unicorn-14376.exe	106
PID 2328 wrote to memory of 540	2328	Unicorn-14376.exe	106
PID 3340 wrote to memory of 2364	3340	Unicorn-45684.exe	108
PID 3340 wrote to memory of 2364	3340	Unicorn-45684.exe	108
PID 3340 wrote to memory of 2364	3340	Unicorn-45684.exe	108
PID 3732 wrote to memory of 2392	3732	Unicorn-20498.exe	107
PID 3732 wrote to memory of 2392	3732	Unicorn-20498.exe	107
PID 3732 wrote to memory of 2392	3732	Unicorn-20498.exe	107
PID 2704 wrote to memory of 1636	2704	Unicorn-43711.exe	109
PID 2704 wrote to memory of 1636	2704	Unicorn-43711.exe	109
PID 2704 wrote to memory of 1636	2704	Unicorn-43711.exe	109
PID 4844 wrote to memory of 3044	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	110
PID 4844 wrote to memory of 3044	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	110
PID 4844 wrote to memory of 3044	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	110
PID 3312 wrote to memory of 2116	3312	Unicorn-1828.exe	111
PID 3312 wrote to memory of 2116	3312	Unicorn-1828.exe	111
PID 3312 wrote to memory of 2116	3312	Unicorn-1828.exe	111
PID 540 wrote to memory of 4380	540	Unicorn-42493.exe	112
PID 540 wrote to memory of 4380	540	Unicorn-42493.exe	112
PID 540 wrote to memory of 4380	540	Unicorn-42493.exe	112
PID 2328 wrote to memory of 5072	2328	Unicorn-14376.exe	113
PID 2328 wrote to memory of 5072	2328	Unicorn-14376.exe	113
PID 2328 wrote to memory of 5072	2328	Unicorn-14376.exe	113
PID 2364 wrote to memory of 4888	2364	Unicorn-6291.exe	114
PID 2364 wrote to memory of 4888	2364	Unicorn-6291.exe	114
PID 2364 wrote to memory of 4888	2364	Unicorn-6291.exe	114
PID 2392 wrote to memory of 1416	2392	Unicorn-26157.exe	115
PID 2392 wrote to memory of 1416	2392	Unicorn-26157.exe	115
PID 2392 wrote to memory of 1416	2392	Unicorn-26157.exe	115
PID 3340 wrote to memory of 1148	3340	Unicorn-45684.exe	117
PID 3340 wrote to memory of 1148	3340	Unicorn-45684.exe	117
PID 3340 wrote to memory of 1148	3340	Unicorn-45684.exe	117
PID 3044 wrote to memory of 2264	3044	Unicorn-29976.exe	118
PID 3044 wrote to memory of 2264	3044	Unicorn-29976.exe	118
PID 3044 wrote to memory of 2264	3044	Unicorn-29976.exe	118
PID 3732 wrote to memory of 4704	3732	Unicorn-20498.exe	116
PID 3732 wrote to memory of 4704	3732	Unicorn-20498.exe	116
PID 3732 wrote to memory of 4704	3732	Unicorn-20498.exe	116
PID 4844 wrote to memory of 672	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	119
PID 4844 wrote to memory of 672	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	119
PID 4844 wrote to memory of 672	4844	755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe	119
PID 1636 wrote to memory of 3748	1636	Unicorn-30241.exe	121
PID 1636 wrote to memory of 3748	1636	Unicorn-30241.exe	121
PID 1636 wrote to memory of 3748	1636	Unicorn-30241.exe	121
PID 2116 wrote to memory of 3720	2116	Unicorn-11666.exe	120

C:\Users\Admin\AppData\Local\Temp\755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\755f34ff37b113791105cc5879264d50_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 720
      4⤵
      Program crash
      PID:4604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 728
      4⤵
      Program crash
      PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        9⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        9⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        9⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        9⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51439.exe
        9⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        9⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        8⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
        8⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        8⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        8⤵
        
        PID:18120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        8⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53639.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        7⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        6⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        8⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        7⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        7⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        7⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        7⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17067.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33993.exe
        6⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        8⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        8⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        7⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        7⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        7⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        5⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        7⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        6⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        6⤵
        
        PID:17728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59462.exe
        5⤵
        
        PID:18100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        7⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
        7⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        7⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        6⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        6⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        7⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27311.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        6⤵
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        6⤵
        
        PID:18392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
        5⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
        5⤵
        
        PID:16792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        7⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        7⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        7⤵
        
        PID:18320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46911.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        6⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
        6⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        5⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        5⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        6⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        5⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37747.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
      4⤵
      PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
      4⤵
      PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
      4⤵
      PID:608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11666.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43469.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        7⤵
        
        PID:18164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18164 -s 176
        8⤵
        Program crash
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        6⤵
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        6⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exe
        5⤵
        
        PID:5628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 728
        6⤵
        Program crash
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43554.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        5⤵
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe
        5⤵
        
        PID:11044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26174.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
        6⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57095.exe
        5⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1002.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4356.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44660.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        6⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7083.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34484.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
      4⤵
      PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
      4⤵
      PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
      4⤵
      PID:13432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
      4⤵
      PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
      4⤵
      PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50090.exe
      4⤵
      PID:7772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30958.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        7⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
        6⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        6⤵
        
        PID:17888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        6⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        5⤵
        
        PID:18228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        5⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        5⤵
        
        PID:14320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
        5⤵
        
        PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64287.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30918.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe
      4⤵
      PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
      4⤵
      PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
      4⤵
      PID:11028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56007.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        6⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        6⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        5⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        5⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34023.exe
      4⤵
      PID:7056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 632
        5⤵
        Program crash
        
        PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      4⤵
      PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exe
      4⤵
      PID:13048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
      4⤵
      PID:64
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
      4⤵
      PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        5⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
      4⤵
      PID:16228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
    3⤵
    PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
      4⤵
      PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
      4⤵
      PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
    3⤵
    PID:9752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
    3⤵
    PID:12908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
    3⤵
    PID:16676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
    3⤵
    PID:232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
    3⤵
    PID:14960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63053.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        9⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        9⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        9⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25112.exe
        9⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exe
        9⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
        9⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        9⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        9⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        8⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        8⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        8⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        9⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
        9⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        9⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61904.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
        8⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        8⤵
        
        PID:18156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24712.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33315.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        7⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7900.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        8⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        8⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        8⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        7⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61048.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        7⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        7⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50971.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        8⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        8⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        7⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        6⤵
        
        PID:13896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        6⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24445.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe
        8⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        7⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
        7⤵
        
        PID:18008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48022.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        7⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54564.exe
        6⤵
        
        PID:17056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64427.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        8⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11915.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53458.exe
        8⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1986.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        7⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        6⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        7⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
        6⤵
        
        PID:17936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        5⤵
        
        PID:13256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        5⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        5⤵
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        7⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59893.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55183.exe
        8⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        7⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37747.exe
        7⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20730.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11531.exe
        7⤵
        
        PID:18048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        7⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        6⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5651.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        7⤵
        
        PID:17740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        7⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2615.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61380.exe
        6⤵
        
        PID:18336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        6⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        7⤵
        
        PID:18404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        6⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        5⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        6⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33609.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        7⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
        6⤵
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
        6⤵
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-519.exe
        6⤵
        
        PID:17716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        5⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25906.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        5⤵
        
        PID:17768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41512.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        6⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        6⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        5⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61380.exe
        5⤵
        
        PID:18364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45047.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        5⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        5⤵
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65497.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22742.exe
      4⤵
      PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41875.exe
      4⤵
      PID:18428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        8⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
        8⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        8⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23610.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        7⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        7⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54889.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        6⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        7⤵
        
        PID:18064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        6⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        7⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        6⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2522.exe
        6⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
        5⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        5⤵
        
        PID:17368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        5⤵
        
        PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23279.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        7⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
        6⤵
        
        PID:17872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        6⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56840.exe
        6⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        5⤵
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55721.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        6⤵
        
        PID:18144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        5⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        5⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32791.exe
        5⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
      4⤵
      PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
      4⤵
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
        6⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18287.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        7⤵
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        6⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        6⤵
        
        PID:18088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18088 -s 212
        7⤵
        Program crash
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44032.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
      4⤵
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45435.exe
        5⤵
        
        PID:17760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        5⤵
        
        PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
      4⤵
      PID:15940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
      4⤵
      PID:14980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19747.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19963.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        6⤵
        
        PID:17984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        5⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        5⤵
        
        PID:17540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37531.exe
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        5⤵
        
        PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      4⤵
      PID:10840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
      4⤵
      PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
      4⤵
      PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
    3⤵
    PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        5⤵
        
        PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47103.exe
      4⤵
      PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
      4⤵
      PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
      4⤵
      PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
    3⤵
    PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
      4⤵
      PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
      4⤵
      PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
      4⤵
      PID:18360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
    3⤵
    PID:8924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exe
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exe
    3⤵
    PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31884.exe
    3⤵
    PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
    3⤵
    PID:3800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
        8⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        8⤵
        
        PID:18076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57436.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        7⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38543.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        7⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        7⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
        7⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        6⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        7⤵
        
        PID:18244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
        6⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        6⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        6⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
      4⤵
      Executes dropped EXE
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        7⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        7⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41448.exe
        6⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        5⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        5⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
        5⤵
        
        PID:18380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
      4⤵
      PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
      4⤵
      PID:13576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exe
      4⤵
      PID:18204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19490.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
        7⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe
        7⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        6⤵
        
        PID:16016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49976.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        6⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        5⤵
        
        PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        6⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        6⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        5⤵
        
        PID:16948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38669.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        5⤵
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        5⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
      4⤵
      PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
      4⤵
      PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47013.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        6⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        6⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        5⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
        5⤵
        
        PID:17664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33033.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe
      4⤵
      PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        5⤵
        
        PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33472.exe
      4⤵
      PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
      4⤵
      PID:16692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16692 -s 248
        5⤵
        Program crash
        
        PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55425.exe
      4⤵
      PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        5⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        5⤵
        
        PID:17812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
      4⤵
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
    3⤵
    PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
      4⤵
      PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
      4⤵
      PID:16552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
    3⤵
    PID:9052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
    3⤵
    PID:12348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
    3⤵
    PID:15996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
    3⤵
    PID:7600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        6⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
        6⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
        6⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
        5⤵
        
        PID:6756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 712
        6⤵
        Program crash
        
        PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        5⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28042.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        5⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exe
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        5⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        5⤵
        
        PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46912.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16098.exe
      4⤵
      PID:12912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
      4⤵
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        6⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        5⤵
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        5⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        5⤵
        
        PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
      4⤵
      PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
      4⤵
      PID:17212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9554.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        5⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
      4⤵
      PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47103.exe
      4⤵
      PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
      4⤵
      PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47065.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
    3⤵
    PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
      4⤵
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
      4⤵
      PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
      4⤵
      PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60090.exe
      4⤵
      PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
    3⤵
    PID:9672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
    3⤵
    PID:13200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
    3⤵
    PID:16888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
    3⤵
    PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
    3⤵
    PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39421.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54327.exe
        6⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        6⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        5⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
        5⤵
        
        PID:18388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31911.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        5⤵
        
        PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44171.exe
      4⤵
      PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
      4⤵
      PID:12460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
      4⤵
      PID:15884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7903.exe
      4⤵
      PID:17708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
      4⤵
      PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
    3⤵
    PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30153.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33507.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        5⤵
        
        PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6971.exe
      4⤵
      PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49673.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        5⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        5⤵
        
        PID:18200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
      4⤵
      PID:17880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
      4⤵
      PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
      4⤵
      PID:14384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
      4⤵
      PID:8052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
    3⤵
    PID:8368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59295.exe
    3⤵
    PID:11940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
    3⤵
    PID:14720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
    3⤵
    PID:17932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
    3⤵
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        5⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        5⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
      4⤵
      PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      4⤵
      PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
      4⤵
      PID:16696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
    3⤵
    PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35065.exe
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51536.exe
      4⤵
      PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
      4⤵
      PID:17816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
    3⤵
    PID:9736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
    3⤵
    PID:12952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
    3⤵
    PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
    3⤵
    PID:6508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
  2⤵
  PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
    3⤵
    PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55721.exe
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
      4⤵
      PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
      4⤵
      PID:18176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
      4⤵
      PID:12748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
    3⤵
    PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
    3⤵
    PID:12896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
    3⤵
    PID:15948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
    3⤵
    PID:17904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe
  2⤵
  PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
    3⤵
    PID:11588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
    3⤵
    PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
    3⤵
    PID:1540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
  2⤵
  PID:8380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
  2⤵
  PID:12272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
  2⤵
  PID:15372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
  2⤵
  PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4456 -ip 4456
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4456 -ip 4456
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5628 -ip 5628
1⤵
PID:6556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7056 -ip 7056
1⤵
PID:11476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 16692 -ip 16692
1⤵
PID:16908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 18164 -ip 18164
1⤵
PID:18336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 18088 -ip 18088
1⤵
PID:18360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:14948

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11666.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11666.exe
Size 184KB
SHA256 8ba9750e4177bec1695f6bc27c15fb603761b0cad9bc011e29027850ed9d2980
MD5 874d1d55cccee04a242ccfd25eda6716
SHA1 baf04a8cc474c4f1698b82ce0f05088f4cfcdddf
SHA512 3d9396de98567e8f61a646d22d7f6f2caec6a126845f520dd2a2c64a75ce3008f1dd68dfe422af8827c9b19d11f534fed9fcb3987b48bb644d17aa93df3890a3
SSDEEP 3072:/UukavoR3NQUrj0PX9rj6WZ6LvMqnviuO:/UIo4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-12.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
Size 184KB
SHA256 be04a472655d1e088afd31d4b3a8d8d0a9e85b5ed9891acbf5ef918eceaaf7a7
MD5 659ced24ea53e04a8a8f1d02c450e82d
SHA1 7130a6b5d88a3d88c261ddb70a1ded4049ef5aea
SHA512 65a9ea1592c11030fbbced20d709a33a5fc5821bbf0c1c7c625cb73b439310b513bd7ffc36596b84d10fe792257ea5084ae97887afd499af2bb1a0ed1eddf2d5
SSDEEP 3072:hUukavoR3NQUrj0PX9rj6WZ6LvMqAviuO:hUIo4Oj0FjxZ6LEqAviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13150.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
Size 184KB
SHA256 6a935bc8557982df42328e15b71f59d6bb6b2f49d7941e1b07996640b29bfe5e
MD5 94db3a7107782b77ebe5ae69497ce44a
SHA1 d205765d542363e4d12f25187a327e17aa730f8b
SHA512 f09638f96996401ae41ba3a3a2563e4fe65c5f34311601f87154cb40ac5f7f14b16b808b58cebc78d8322e56d65f6eb24cde00d91d6e07109abb8153e85c009d
SSDEEP 3072:KU0k4voR3NQUrj0PX9rj6WZ6LvMqnviuF:KUko4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-14376.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
Size 184KB
SHA256 d86a57350579883b33952415fb94381f58e5687d54cca5d37970e9aa76bc55ce
MD5 5ab901f28c9f9de9fb046fc8ca2e905a
SHA1 57ec6538ed05a2e423f0e849760a108cd1500ddc
SHA512 6a31426d9098b51e93a0c3cc6737196b937bc3f94ebca3a54400b8cd8cf07c77b5bc8efcc235a9a00d885a5f6d8191933f07eb9582cf7d53184c6add2d386748
SSDEEP 3072:hU0k4voR3NQUrj0PX9rj6WZ6LvMqnviuF:hUko4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16711.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
Size 184KB
SHA256 52e2e13ca70f2f679cb185ca436546aeb32fc5577f7edf3765e0ed738c16fe06
MD5 83e4b4a5fa59160ef02803b627287473
SHA1 3b0fed6a953532933870a46fba942845f505fecb
SHA512 96685ff0d6644afabc285861f55bbf6d754b1384f9bd375766b8b5e27c9bcf6bc70af05a52d446b0fe702b85ba46d16bf22017ef48238902c08adf22f0cd7b43
SSDEEP 3072:hUukavoR3NQUrj0PX9rj6WZQLvMqnviuO:hUIo4Oj0FjxZQLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-1828.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
Size 184KB
SHA256 3961fdc6e5feb345120f4da9db463498212080c6bb731a53baf8ee7e4beeda5c
MD5 522d7707fac98e07a4ad17664dccb5dd
SHA1 939f04dde5ea4e4ff1c72f8bb9355c84007f1f55
SHA512 8cabee0ce06365b89e0f827655138773134956acec76b16b64984834f0f528d3b7c7c1e8111e27118f1814d702f15cd2a7421c871340c20d5093ba4df49dad0d
SSDEEP 3072:hUukavoR3NQUrj0PX9rj6WZ6LvMqnviuO:hUIo4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20498.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
Size 184KB
SHA256 276fe3ece7c17f448812630ababcd9c389f7ec51114c5d8bfc2377af974e065a
MD5 7c87d83ec73d30b1562fbb7e684b7a20
SHA1 b19b8f51b0678b0d9523c0a3b464a65655cdf6fc
SHA512 861f61a0fabc11b7a1b63b3a90a26a950704cc7be126beb428b26f3a59dbc054d1b07523614f758b559467b39b9db810452edc470e84ae63434d8059ec0c1d01
SSDEEP 3072:hUukqvoR3NQUrj0PX9rj6WZ6LvMqnviuF:hUYo4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2368.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
Size 184KB
SHA256 da252a086408b91c272397bc0ee138a728f80fdbcef8cb059f825dfcd150a9d1
MD5 e3672dc8e8bc8b5cd861b8ad315b8cb4
SHA1 e58ef1fa5513ec40a0a9bf6498d35858da438478
SHA512 6c356b38e7b173a991b4ae9ab483fad41089bc80bb9db71c729e35b9a9bb663ef72354554d25a22210eeeff2166a0ab34af0f85846aa7045bc6bda98979458f4
SSDEEP 3072:hUukqvoR3NQUrj0PXgrj6WZ6LvMqnviuV:hUYo4Oj0SjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-26157.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
Size 184KB
SHA256 59841f17e9b27a8c2d9e2702264ab3e9b7f8aef7c37ed2d539d6c27c527f22dc
MD5 666271f3af4d7e35d4fe430227757d4a
SHA1 3c6e654938b70a15e33f8228ab3e0571bf324c15
SHA512 541f80879a0a79284bc9f6954cd3ab56a231102261767cc177437690a98af3e0c98e1b0e2df98674dc0f343f178c2be97d6705477c4285e14f9133fc7703f3b1
SSDEEP 3072:hUukqvoR3NQUrj0PXgrj6WZ6LvMqnviuF:hUYo4Oj0SjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27122.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
Size 184KB
SHA256 63cbfbe7615e0db84e8a62066a3a1740f6afeb3bd810bd032ecb6cdd285c9b9c
MD5 5be9afd83f6503f2e141dfb2bdb3f362
SHA1 4b0f2e880d373cd4c433661d6822afd847a4e4cd
SHA512 ddfa9cc33a0442eee2b164ec4d0732a08037a2c2637ec913cdb986164502e2072a12ed5a80242c8124a9b6f92ce5b2907e5e7344084f7011881a23333735207e
SSDEEP 3072:hUukavoR3NQUrj0PX9rjsWZ6LvMqnviuF:hUIo4Oj0FjHZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27937.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
Size 184KB
SHA256 4775f6812bf186620f1f1ebf5f7f02d97bc3e1b2d74e677c13e1243132743f94
MD5 79ac41706c99f3fb31dd27fdaa6628fd
SHA1 f781e84b84d2d33912c5e0282bc3f97c0d7e6fe4
SHA512 94c83c2c6eb9694f794cd95bc4ae427c26878a135fb0bf9c249abbe80b1ccfcef200eb1dbf05f23d7487e8d07c3b8ca418df4fe64a3f41848e74883fe305924f
SSDEEP 3072:/UukavoR3NQUrj0PXKrj6WZ6LvMqnviuO:/UIo4Oj0YjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28631.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
Size 184KB
SHA256 a029080276d23a9f8a07be8b993c976ae69bc7ef1ed0b766fd25b12426956132
MD5 49d98135f609719284e39a756043d959
SHA1 e0b50091eb3012f46d1261399646c0d6dc3f1140
SHA512 f8f50810f98983e33f91201b5152d3fd04e4537f6c707183331c0016d09ca3d3ddbad5933e81aff45be809e3dd70e9829c5e887da75fbb3a612afbecad8cf51a
SSDEEP 3072:hU0k4voR3NQUrj0PX9rj6WZ9LvMqnviuF:hUko4Oj0FjxZ9LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29976.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
Size 184KB
SHA256 d600448d2bdd2e2c1a2e150f5599962ef69e55df548367a2edc8eed427939f43
MD5 88ab25f533b2420f427a00f2dddfc812
SHA1 d0935782a4016e3d2c8a357fa17f00b5492e63e5
SHA512 b97a5635fa1edd1bccc32810e51f9082590ad74b64294182e55b57cb2ceb203777f854496c3ab46909b227d08530d3874c0f82bacddbd3bdb31d5b36c8f9517f
SSDEEP 3072:hUukavoR3NQUrj0PX9rj6WZhLvMqnviuF:hUIo4Oj0FjxZhLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30241.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
Size 184KB
SHA256 008721c37794211829de08982fd584e42224d1a456161406c9a670983692f0ef
MD5 71e2af58793662edfb2858c5f047c99c
SHA1 04128e34acf9d9b1c3f1b856ff8e00f6c29d79c3
SHA512 61ff05438c0eef93c16c09b20d6450f78fd5b3f87691f0b65a6b91239b856547e0d5c86215e0f3dc0073205d7967e079f1313b33ec661a92cdbc0a31ea781ef2
SSDEEP 3072:hyukavoR3NQUrj0PX98j6WZ6LvMqnviuO:hyIo4Oj0ajxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31969.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
Size 184KB
SHA256 2bfcec6604437a6ac57301433fe6516c8b1a2bc823b1c3ff96acd0199f8f415c
MD5 114e00495a3c92c4d40d82d7fdabcf94
SHA1 7998c02bbc948bc9567fd25ad1e566d164e9791d
SHA512 75982f2d9307f4695e68a6dc9ed6519e59f9c6220080730eb4a13cc854e0b17b9fbf446a697bef5e03dbcd94bdbf863c7ed22208806926baf9889e470994c6f5
SSDEEP 3072:hyukavoR3NQUrj0PX98j+WZ6LvMqnviuO:hyIo4Oj0aj1Z6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32523.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
Size 184KB
SHA256 eb10f29b01dfa109b85e2cad9b9289581831e1a6248dd0494645046b73af9d3f
MD5 7d7d3044f4027f1d5289fced012e2f8b
SHA1 53646504c2a7c138a6ec1da8458e7a713905e81e
SHA512 8a762a815ebb60ae800d6018c3b5428426731d0e208038e74eb1fda0836e195214f7fb45736c448112225b5e8a153f7f41f74787c48fb667e572f661c9933358
SSDEEP 3072:hUukqvoR3NQUrj0PX9rj6WZjLvMqnviuF:hUYo4Oj0FjxZjLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3380.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
Size 184KB
SHA256 e5cb42e8cbefe552dfe9eb78742776c246963a48b1f44ab3b88d950df930cd99
MD5 190c6d0bf5812f8cbe9cd4fe02d6cfbe
SHA1 e066c244d2fbdb52a9a3341d641599823f590833
SHA512 d01606ffbfe124cac2dc30b5dbd4b6c54bb0ad82c6b73a61b66bee9ba6f0c58367c67eff3e55b3e9c12e391ea6c402d9e3b052a3699f43cf8c1718132ee80dd4
SSDEEP 3072:hUukqvoR3NQUrj0PXgrj6WZ6LvMqnviu9:hUYo4Oj0SjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-35233.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
Size 184KB
SHA256 fdcc3ac9a7955c65ce88e9ca3208f6e1f66f2714d0d50fec48251bf52a32ce7c
MD5 998be5429df644f88eb6c437fde71344
SHA1 bdcda2f7f2680d9d5e0d862a8808ee0987783663
SHA512 a7ab2d02f609ffc7568a0057166b3eeda4922b6db4df65eb6b1f0787ae86349910f50befff496533306bafa1040da08f796e68fa7456553c2f6237a1e4cc0953
SSDEEP 3072:hU0kavoR3NQUrj0PX9rj6WZ0LvMqnviuF:hU2o4Oj0FjxZ0LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-35595.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
Size 184KB
SHA256 992faa5ef36833476f1cbf3b1a88704401038b2256ec19ea03767017bb00913c
MD5 7aee7cad2a2a9c1652f1950c7b2d43e5
SHA1 3a708954119d27545ef2257529bed1e0ddd4a368
SHA512 5e8c74b8dbce0e828780636bb98eb7495602dd5de2b017cacba94de40ce6f07b8cd5182586c410b87e0d8855d8a59a779f79a73cb66e781a0b184bc2f80c4df8
SSDEEP 3072:hUukqvoR3NQUrj0PXgrj6WZ6LvMqnviuM:hUYo4Oj0SjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38357.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
Size 184KB
SHA256 296866f2d157995e90f58807ac5c6b15a7af51871171b143dab5494749718cb1
MD5 1af192e4b07d9eb420e07fd0a852416f
SHA1 261b457762227b627d3a2b125fc9d091a7ebe347
SHA512 76a04e9838b612e763e0697ab2780be86bf3e393bda65cf55450d32e59c536430a770eef810b101fb5067a026018abc3ff1a632d5632f63120a7735880e8fb70
SSDEEP 3072:hU0k4voR3NQUrj0PX9rj6WZ9LvMqnviuF:hUko4Oj0FjxZ9LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39103.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
Size 184KB
SHA256 f428780bf321987a51139847655f47bb98322137c3f87462526ac4301578c976
MD5 0c6674338740dbabc3ab96388e0043d4
SHA1 0e009c96ff244156b656167be83706c895af506c
SHA512 04a322404d3b8e3f3b63161272cfe118312f010dd25c0bb0a8d9153c1a0cd38fa449b561d54166d0c1f156185ddeee107d017b9e941ba10bd9ef22c1694d2ad8
SSDEEP 3072:hU0k4voR3NQUrj0PX9rj6WZfLvMqnviuF:hUko4Oj0FjxZfLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42493.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42493.exe
Size 184KB
SHA256 ecaf0831bb16cfdf3b47b9ed0b000a0809c8426e96670049e3bc16cfa87f1d89
MD5 6e6d77fcb2e893d45f0d3d2efb63b62a
SHA1 282344508faa604d6180e82cbe7a72103ca742f8
SHA512 1470ea4a55408e86c8d7af681938b74655558922e2b943338623fc59c628f220575289a8c9c13067613a7c214ca7e51786c2cef0ef0185b4638db2b2479cbceb
SSDEEP 3072:hU0k4voR3NQUrj0PX9rj6WZfLvMqnviuF:hUko4Oj0FjxZfLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43711.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exe
Size 184KB
SHA256 450d92b81b69a87436aecd6e0dd2831a93aa4d453fac1472a863bf7742cfaca8
MD5 73ada52615d6d1e617c8b94e81d91e78
SHA1 e2ac5035ede62a59a862053db76bcd799ba065e3
SHA512 b799ef87ba7c31e4e5acc0906fb28d22d66da933dc9d22368fd7d5106fb0f3fefe4ecc4236edd7a6a9749aaaa9e350f6b453b72b162e3d80508e8a11d1aab113
SSDEEP 3072:hyukavoR3NQUrj0PX9rj6WZ6LvMqnviuO:hyIo4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44245.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exe
Size 184KB
SHA256 e210da21a2175443dbdd45c9f19ac3edbc2c8f0c9f8df0c7b12fd605e516bea9
MD5 d2469133018bd4549db9ed823a352728
SHA1 f6af0e54d6097795b801b0ab1e66fbf7094454d1
SHA512 a7665618cfac35e5bef82b2e980386ce7d85e917ad0c526f73ed58a5c9d4b5cd206e786f07e5e8918c2bb7562268d9a06c799a106dab8aa4ada19203f25294a4
SSDEEP 3072:QUukqvoR3NQvrj0PX9rj6WZjLvMqnviuF:QUYo4jj0FjxZjLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45684.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
Size 184KB
SHA256 16414b6bce3af391dca06aa9c805ba72d3dad22b84227d2d917a86eb2e239888
MD5 00631e4df9e20e52102878567dd0fe64
SHA1 5d816b59f9c97f0b9a79b2b3c47cba765fe8f3dd
SHA512 232c2abf3d4786d908c81a5de6fd3343d103ef0efbfbc8f4b5c26e6713dd603dd1b76993d41cff0230c056f56b373a08e24cbbc9213092fc63c69e530d73f83a
SSDEEP 3072:hU0kavoR3NQUrj0PX9rj6WZ6LvMqnviuF:hU2o4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46259.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
Size 184KB
SHA256 e4605dded91decd690fe1ce595416ae3e3e50001c7302617cafb512a23edc903
MD5 8c4888ac09938b637b7c3dd456c43281
SHA1 3a9c030d5db9fb28b02d893a7ed6b7313fe13a23
SHA512 e6f6bb820b3a1a4c6524f15880b2d58bf17a5799052756c15a787a320b9c4266e3479d42b932b04ddddb37aaf8216279f3bc8b45d6978d1bd03aa212f509762c
SSDEEP 3072:hU0kavoR3NQUrj0PX9rj6WZaLvMqnviuF:hU2o4Oj0FjxZaLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47690.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
Size 184KB
SHA256 61989b3876c072e736ee5719c17e5632d363f414f240198983791edaacde88d0
MD5 4fc6a39932c85b295ecb2298d3f6b412
SHA1 002b7cf718eec8e75a3f058d1d6ea20bf63948a8
SHA512 f55ee04c1eb2bd904c57a4e7ffe35cd59a6d481ada75956e48505ace5e1177a6262b965771ec7b99764b13ecba730cc3e7c3acab22a75f653c40bb943b866241
SSDEEP 3072:EUukavoR3NQUrj0PX9rj6WZ6LvMqnviuT:EUIo4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48305.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
Size 184KB
SHA256 71bb7484973472175d4eb980ad34ee246a7922a279ee8992f34f6fd035376bec
MD5 778d61323be01dfb6852db50f87f7d88
SHA1 83fe0c31393e99fd252b06b40f718b7b4b929584
SHA512 f3c0751c6bf9d049682df43bff4a47279661b0f3cdc65cfe2b15f9dca4064076e89dca6672536542c91003b9aeaf6e43c7a59841356a6ab62ff1caaa885edf1d
SSDEEP 3072:hUukavoR3NQUrj0PX9rj6WZsLvMqnviuF:hUIo4Oj0FjxZsLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56665.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
Size 184KB
SHA256 adef1cb1a92c76401956003dbf64f84adb64256f3e71a88e87715c6811abb81a
MD5 f6544c19bdecbd323ed18b5cb387b3b7
SHA1 b817bb667c52c876b569269252b92e978295b606
SHA512 e80594291439a627408668b369fc566ce4ec61d527e0c563f3bc87ff1b48312c0dd74d2a6a79eb7b8d9122e19b70313ffbfd2d59cc5add7d98bea2433267d711
SSDEEP 3072:hU0kavoR3NQUrj0PX9rj6WZ6LvMqnviuF:hU2o4Oj0FjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62648.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
Size 184KB
SHA256 ae3f211414d3778fb73aa980b647ff7d5db6f6928fac4ff27f56e67969126468
MD5 232c897feb196964d0dda6aad79c3901
SHA1 e27fc51a81200437c2e285712ae9fbe21b0b3601
SHA512 bc53974074c21dc972bcfee14d3a236e51c03dc430124a5493b91a2b3655ca8c975aacece826f5605e04fc80ca156593c2c4d15bed82d74deb16d633f2e436d4
SSDEEP 3072:hyukavoR3NQUrj0PXOrj6WZ6LvMqnviuO:hyIo4Oj0kjxZ6LEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6291.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
Size 184KB
SHA256 48a2680264fa16cc148aece9a5c0ad70a4405c584467a33071b72715c2936a72
MD5 aacac046b29b6023b65696ce6dbbef8a
SHA1 a0a00a9a10e35a14600414edcf018a5819785aff
SHA512 34e648855b9fe57479cc0e684ac051cfbc926dd7da3e342dfd0a036aafe60b9f3044ff77a51492a7a68fec822e7b19b8446fdee2de11a46c9bbb308a1c0906a4
SSDEEP 3072:hU0kavoR3NQUrj0PX9rj6WZpLvMqnviuF:hU2o4Oj0FjxZpLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63053.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63053.exe
Size 184KB
SHA256 31a04a4d686b437683e7dae18ca858d4a76da15c5b40a89a731596fcb4778dbf
MD5 811cb47095fd2e77cf7b31180918d780
SHA1 414c3ad69decfab900a2eba27c4b081ba4828877
SHA512 06cf180237e0970208cfc4cb5145864d9249acaf2a86cd711ab83f351fbf2296bc29fbe4a82d0a1d6fb489a766b4e97e6acb0a770714f1248b5c97e81d42c5fc
SSDEEP 3072:hU0k4voR3NQUrj0PX9rj6WZzfvMqnviuF:hUko4Oj0FjxZzfEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-64376.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
Size 184KB
SHA256 f85293e0fd7bd8aa68118dd7757add820ad24f9ff9632df8cad9e6c386eef77b
MD5 4daaadbe28b9966143f693ed3f7d0d83
SHA1 bb40514221a4249453ce40d84a4913d8fdbe092f
SHA512 7dc6c42a913d10fb950c1d40f8ac93a08337423ee97a62fd5ff80ca0b0a6a87376516d17d813dcf9dff4669e126c0d78158607bce339ab37cc2562ce3794b1e3
SSDEEP 3072:hU0kavoR3NQUrj0PX9Nj6WZpLvMqnviuF:hU2o4Oj0TjxZpLEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65025.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
Size 184KB
SHA256 7b86153131abcaf8e4ef2b7af4f25dc980cfb58fba75aa421e0c6f8ea4cb2ce2
MD5 d87fd049d96f3475eed16a53f82c7059
SHA1 7070159a86adc12ef676d7739174871e40a3a16e
SHA512 125ea39c78743e1859497be08d663045b7368c3149b2b1cbb85f3a4b2206ad31b67525b7ad6077273d35b12f14247eca26b255395f31a0166db157919d8cfebf
SSDEEP 3072:hU0k4voR3NQUrj0PX9rj6WZffvMqnviuF:hUko4Oj0FjxZffEqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/13432-1965-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/13432-3896-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads