ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe
Size

468KB
MD5

f08066f62c9b5fdf443d7bf11e256fe3
SHA1

016231afcfcb5eac9a36ae259cdf78232855c3cd
SHA256

ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9
SHA512

46eb9780002017c228efc306abbde385ac64df7ddcb813c785010d7b9e827583b9be461a893f7021f9739a0534b4b107aeb5cb490a211224b46558a9eb504fef
SSDEEP

3072:WqoCogLdTY8U2bYkPz5jff5EChjWIpRnmHevVpW+eh3XgMND0lv:WqNo41U23P1jffs0HO+eZwMND

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4572	Unicorn-60051.exe
3556	Unicorn-44307.exe
2040	Unicorn-13616.exe
1540	Unicorn-13113.exe
5096	Unicorn-13305.exe
4128	Unicorn-58977.exe
2968	Unicorn-37025.exe
2148	Unicorn-29619.exe
3452	Unicorn-7152.exe
3784	Unicorn-29235.exe
2272	Unicorn-44995.exe
3196	Unicorn-28659.exe
4436	Unicorn-64273.exe
1264	Unicorn-41657.exe
3300	Unicorn-8793.exe
968	Unicorn-59354.exe
2592	Unicorn-29635.exe
3644	Unicorn-48913.exe
2324	Unicorn-1378.exe
3484	Unicorn-46888.exe
4232	Unicorn-17331.exe
4548	Unicorn-57217.exe
4640	Unicorn-610.exe
4536	Unicorn-29369.exe
4692	Unicorn-60017.exe
2708	Unicorn-16563.exe
720	Unicorn-36106.exe
1696	Unicorn-64730.exe
4752	Unicorn-16240.exe
2356	Unicorn-26563.exe
1280	Unicorn-20624.exe
1052	Unicorn-32266.exe
1580	Unicorn-8617.exe
2980	Unicorn-48026.exe
2964	Unicorn-3408.exe
1968	Unicorn-3890.exe
2984	Unicorn-19651.exe
4168	Unicorn-64938.exe
4736	Unicorn-2546.exe
2920	Unicorn-58954.exe
1136	Unicorn-40346.exe
2896	Unicorn-553.exe
2612	Unicorn-23818.exe
2148	Unicorn-20345.exe
3288	Unicorn-23107.exe
1552	Unicorn-3433.exe
3960	Unicorn-6386.exe
2848	Unicorn-42001.exe
2912	Unicorn-6002.exe
2788	Unicorn-6002.exe
3272	Unicorn-41882.exe
1176	Unicorn-64.exe
3188	Unicorn-51290.exe
2036	Unicorn-21955.exe
2168	Unicorn-32352.exe
3740	Unicorn-5488.exe
4516	Unicorn-15824.exe
980	Unicorn-42457.exe
2688	Unicorn-62058.exe
1664	Unicorn-62899.exe
680	Unicorn-62323.exe
1528	Unicorn-34586.exe
1972	Unicorn-64113.exe
3372	Unicorn-14850.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
400	3784	WerFault.exe	94
6008	3196	WerFault.exe	95
6024	720	WerFault.exe	112
7480	3740	WerFault.exe	144
6732	2036	WerFault.exe	142
7108	2844	WerFault.exe	178
15312	9144	WerFault.exe	419
9904	2404	WerFault.exe	804
12380	5088	WerFault.exe	837
9576	4788	WerFault.exe	822

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2540	dwm.exe
Token: SeChangeNotifyPrivilege	2540	dwm.exe
Token: 33	2540	dwm.exe
Token: SeIncBasePriorityPrivilege	2540	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe
4572	Unicorn-60051.exe
3556	Unicorn-44307.exe
2040	Unicorn-13616.exe
1540	Unicorn-13113.exe
4128	Unicorn-58977.exe
5096	Unicorn-13305.exe
2968	Unicorn-37025.exe
3452	Unicorn-7152.exe
3784	Unicorn-29235.exe
1264	Unicorn-41657.exe
4436	Unicorn-64273.exe
2272	Unicorn-44995.exe
3196	Unicorn-28659.exe
3300	Unicorn-8793.exe
968	Unicorn-59354.exe
2592	Unicorn-29635.exe
3644	Unicorn-48913.exe
2324	Unicorn-1378.exe
3484	Unicorn-46888.exe
4232	Unicorn-17331.exe
4548	Unicorn-57217.exe
4640	Unicorn-610.exe
1696	Unicorn-64730.exe
4692	Unicorn-60017.exe
4536	Unicorn-29369.exe
4752	Unicorn-16240.exe
2708	Unicorn-16563.exe
720	Unicorn-36106.exe
2356	Unicorn-26563.exe
1280	Unicorn-20624.exe
1052	Unicorn-32266.exe
1580	Unicorn-8617.exe
2980	Unicorn-48026.exe
2964	Unicorn-3408.exe
1968	Unicorn-3890.exe
2984	Unicorn-19651.exe
4168	Unicorn-64938.exe
4736	Unicorn-2546.exe
2920	Unicorn-58954.exe
1136	Unicorn-40346.exe
2896	Unicorn-553.exe
2612	Unicorn-23818.exe
2148	Unicorn-20345.exe
3288	Unicorn-23107.exe
3960	Unicorn-6386.exe
1552	Unicorn-3433.exe
2848	Unicorn-42001.exe
2912	Unicorn-6002.exe
3272	Unicorn-41882.exe
2788	Unicorn-6002.exe
1176	Unicorn-64.exe
3188	Unicorn-51290.exe
2036	Unicorn-21955.exe
2168	Unicorn-32352.exe
4516	Unicorn-15824.exe
3740	Unicorn-5488.exe
1664	Unicorn-62899.exe
2688	Unicorn-62058.exe
980	Unicorn-42457.exe
1972	Unicorn-64113.exe
680	Unicorn-62323.exe
1528	Unicorn-34586.exe
3372	Unicorn-14850.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4572	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	85
PID 1152 wrote to memory of 4572	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	85
PID 1152 wrote to memory of 4572	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	85
PID 4572 wrote to memory of 3556	4572	Unicorn-60051.exe	86
PID 4572 wrote to memory of 3556	4572	Unicorn-60051.exe	86
PID 4572 wrote to memory of 3556	4572	Unicorn-60051.exe	86
PID 1152 wrote to memory of 2040	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	87
PID 1152 wrote to memory of 2040	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	87
PID 1152 wrote to memory of 2040	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	87
PID 3556 wrote to memory of 1540	3556	Unicorn-44307.exe	88
PID 3556 wrote to memory of 1540	3556	Unicorn-44307.exe	88
PID 3556 wrote to memory of 1540	3556	Unicorn-44307.exe	88
PID 2040 wrote to memory of 5096	2040	Unicorn-13616.exe	89
PID 2040 wrote to memory of 5096	2040	Unicorn-13616.exe	89
PID 2040 wrote to memory of 5096	2040	Unicorn-13616.exe	89
PID 4572 wrote to memory of 4128	4572	Unicorn-60051.exe	90
PID 4572 wrote to memory of 4128	4572	Unicorn-60051.exe	90
PID 4572 wrote to memory of 4128	4572	Unicorn-60051.exe	90
PID 1152 wrote to memory of 2968	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	91
PID 1152 wrote to memory of 2968	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	91
PID 1152 wrote to memory of 2968	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	91
PID 4128 wrote to memory of 2148	4128	Unicorn-58977.exe	92
PID 4128 wrote to memory of 2148	4128	Unicorn-58977.exe	92
PID 4128 wrote to memory of 2148	4128	Unicorn-58977.exe	92
PID 4572 wrote to memory of 3452	4572	Unicorn-60051.exe	93
PID 4572 wrote to memory of 3452	4572	Unicorn-60051.exe	93
PID 4572 wrote to memory of 3452	4572	Unicorn-60051.exe	93
PID 5096 wrote to memory of 3196	5096	Unicorn-13305.exe	95
PID 5096 wrote to memory of 3196	5096	Unicorn-13305.exe	95
PID 5096 wrote to memory of 3196	5096	Unicorn-13305.exe	95
PID 2968 wrote to memory of 2272	2968	Unicorn-37025.exe	97
PID 2968 wrote to memory of 2272	2968	Unicorn-37025.exe	97
PID 2968 wrote to memory of 2272	2968	Unicorn-37025.exe	97
PID 1540 wrote to memory of 3784	1540	Unicorn-13113.exe	94
PID 1540 wrote to memory of 3784	1540	Unicorn-13113.exe	94
PID 1540 wrote to memory of 3784	1540	Unicorn-13113.exe	94
PID 3556 wrote to memory of 3300	3556	Unicorn-44307.exe	96
PID 3556 wrote to memory of 3300	3556	Unicorn-44307.exe	96
PID 3556 wrote to memory of 3300	3556	Unicorn-44307.exe	96
PID 1152 wrote to memory of 4436	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	99
PID 1152 wrote to memory of 4436	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	99
PID 1152 wrote to memory of 4436	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	99
PID 2040 wrote to memory of 1264	2040	Unicorn-13616.exe	98
PID 2040 wrote to memory of 1264	2040	Unicorn-13616.exe	98
PID 2040 wrote to memory of 1264	2040	Unicorn-13616.exe	98
PID 4128 wrote to memory of 968	4128	Unicorn-58977.exe	100
PID 4128 wrote to memory of 968	4128	Unicorn-58977.exe	100
PID 4128 wrote to memory of 968	4128	Unicorn-58977.exe	100
PID 3452 wrote to memory of 2592	3452	Unicorn-7152.exe	101
PID 3452 wrote to memory of 2592	3452	Unicorn-7152.exe	101
PID 3452 wrote to memory of 2592	3452	Unicorn-7152.exe	101
PID 4572 wrote to memory of 3644	4572	Unicorn-60051.exe	102
PID 4572 wrote to memory of 3644	4572	Unicorn-60051.exe	102
PID 4572 wrote to memory of 3644	4572	Unicorn-60051.exe	102
PID 1264 wrote to memory of 2324	1264	Unicorn-41657.exe	103
PID 1264 wrote to memory of 2324	1264	Unicorn-41657.exe	103
PID 1264 wrote to memory of 2324	1264	Unicorn-41657.exe	103
PID 2040 wrote to memory of 3484	2040	Unicorn-13616.exe	104
PID 2040 wrote to memory of 3484	2040	Unicorn-13616.exe	104
PID 2040 wrote to memory of 3484	2040	Unicorn-13616.exe	104
PID 3300 wrote to memory of 4232	3300	Unicorn-8793.exe	105
PID 3300 wrote to memory of 4232	3300	Unicorn-8793.exe	105
PID 3300 wrote to memory of 4232	3300	Unicorn-8793.exe	105
PID 1152 wrote to memory of 4548	1152	ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe	106

C:\Users\Admin\AppData\Local\Temp\ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe
"C:\Users\Admin\AppData\Local\Temp\ceda68f840d36b506784cac69ffe790d6c4a7e70d4442b232e948b52149d4ba9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 720
        6⤵
        Program crash
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        8⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        9⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        9⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        9⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        9⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        8⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        8⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37281.exe
        8⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        7⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        7⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
        7⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        6⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        6⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        7⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        7⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        6⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        6⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        5⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        5⤵
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        9⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        9⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        9⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46577.exe
        8⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        9⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        9⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        9⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        9⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38593.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        8⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60430.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
        9⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        8⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        8⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18173.exe
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        6⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        9⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3501.exe
        9⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        8⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        8⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        7⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2367.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        7⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        6⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        7⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        6⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21245.exe
        7⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
        6⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        6⤵
        
        PID:16060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
        6⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        7⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        6⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4937.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        5⤵
        
        PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        6⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16768.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
        7⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49446.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        6⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        7⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe
        5⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        5⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
        5⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        6⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        6⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        5⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
        6⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        7⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
        6⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exe
        5⤵
        
        PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45752.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        5⤵
        
        PID:15916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
      4⤵
      PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13976.exe
      4⤵
      PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
      4⤵
      PID:17392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      4⤵
      Executes dropped EXE
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2482.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58931.exe
        9⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        9⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        9⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        9⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22976.exe
        9⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2361.exe
        8⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
        8⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 436
        9⤵
        Program crash
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58931.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        8⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        8⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        8⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        7⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41362.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18240.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        7⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        6⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        7⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
        7⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        7⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46922.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        6⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7296.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
        6⤵
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        6⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        5⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exe
        5⤵
        
        PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        6⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        7⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        6⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        6⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        7⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        5⤵
        
        PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        5⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4994.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        7⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        6⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45386.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        5⤵
        
        PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        6⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        5⤵
        
        PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
      4⤵
      PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        5⤵
        
        PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe
        9⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        9⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
        9⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        9⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51770.exe
        9⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        8⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43369.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        8⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exe
        8⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        7⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9085.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        7⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        7⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        6⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        6⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        6⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        7⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        7⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        6⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        6⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        6⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4969.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57735.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exe
        5⤵
        
        PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        5⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
        7⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42626.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        7⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        7⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        6⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19139.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        6⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11543.exe
      4⤵
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33751.exe
        6⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
        5⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34199.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        6⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        5⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25296.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        5⤵
        
        PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
      4⤵
      PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
      4⤵
      PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48913.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48026.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        5⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        8⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        8⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        7⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59866.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38835.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48958.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        6⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16713.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
      4⤵
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35171.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        6⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        5⤵
        
        PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        6⤵
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        5⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        5⤵
        
        PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4937.exe
      4⤵
      PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
      4⤵
      PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe
      4⤵
      PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
      4⤵
      PID:7444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        6⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        6⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59288.exe
        5⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22496.exe
        5⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        5⤵
        
        PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        5⤵
        
        PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
      4⤵
      PID:10264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
    3⤵
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59048.exe
        5⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        5⤵
        
        PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22464.exe
      4⤵
      PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
      4⤵
      PID:12412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
      4⤵
      PID:9240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35171.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        5⤵
        
        PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
      4⤵
      PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
      4⤵
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
    3⤵
    PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
      4⤵
      PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        5⤵
        
        PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19709.exe
        5⤵
        
        PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26097.exe
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
      4⤵
      PID:10740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
    3⤵
    PID:10172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10537.exe
    3⤵
    PID:12388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
        7⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4034.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36394.exe
        9⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 636
        8⤵
        Program crash
        
        PID:7108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 628
        7⤵
        Program crash
        
        PID:6732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 736
        6⤵
        Program crash
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        8⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exe
        7⤵
        
        PID:10168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 736
        6⤵
        Program crash
        
        PID:7480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 720
        5⤵
        Program crash
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        6⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        8⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        8⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        8⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        7⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        7⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        7⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 464
        8⤵
        Program crash
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        6⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        6⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57057.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
        5⤵
        
        PID:16016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        7⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
        6⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42424.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
        5⤵
        
        PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        5⤵
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
      4⤵
      PID:8680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
        6⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        9⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        8⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        8⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        8⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        7⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        7⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        7⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        7⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        6⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        7⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
        5⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42626.exe
        7⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        6⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33198.exe
        6⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
        6⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        5⤵
        
        PID:9144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9144 -s 720
        6⤵
        Program crash
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42641.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        5⤵
        
        PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48867.exe
        5⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50270.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36129.exe
        7⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        7⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22464.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
        6⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        6⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        7⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exe
        7⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        6⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        6⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        5⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
      4⤵
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10848.exe
        5⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        5⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35581.exe
        5⤵
        
        PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        5⤵
        
        PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
      4⤵
      PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
      4⤵
      PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
      4⤵
      PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46888.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        5⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43161.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        7⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        6⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        6⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        5⤵
        
        PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
      4⤵
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        5⤵
        
        PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50545.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
        5⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
        5⤵
        
        PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
      4⤵
      PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27317.exe
      4⤵
      PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20345.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exe
        5⤵
        
        PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
      4⤵
      PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        5⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        5⤵
        
        PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        5⤵
        
        PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41001.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
      4⤵
      PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
      4⤵
      PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
    3⤵
    PID:8088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
    3⤵
    PID:9352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
    3⤵
    PID:14724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
    3⤵
    PID:13216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44995.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        6⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        8⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        8⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        8⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        8⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
        7⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exe
        7⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
        6⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        7⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        7⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        6⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
        5⤵
        
        PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        5⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49429.exe
        7⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        5⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        6⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        5⤵
        
        PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16784.exe
      4⤵
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        5⤵
        
        PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
      4⤵
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
      4⤵
      PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
      4⤵
      PID:9260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59827.exe
        5⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36051.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19399.exe
        7⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        6⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3369.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        6⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        6⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 464
        7⤵
        Program crash
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        6⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        5⤵
        
        PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        5⤵
        
        PID:16796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
      4⤵
      PID:10612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
      4⤵
      PID:14360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
      4⤵
      PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53914.exe
      4⤵
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58931.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        6⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3129.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59800.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        5⤵
        
        PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
      4⤵
      PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47093.exe
        5⤵
        
        PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
      4⤵
      PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59470.exe
      4⤵
      PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
      4⤵
      PID:12076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exe
      4⤵
      PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
    3⤵
    PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
    3⤵
    PID:12132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
    3⤵
    PID:15908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
    3⤵
    PID:6532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
    3⤵
    PID:17332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        5⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43161.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6084.exe
        6⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22995.exe
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        6⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        5⤵
        
        PID:14232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
        5⤵
        
        PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
      4⤵
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        6⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52715.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        6⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
        5⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
        5⤵
        
        PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        5⤵
        
        PID:16936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
      4⤵
      PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30067.exe
        5⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        5⤵
        
        PID:8956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
      4⤵
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
      4⤵
      PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
      4⤵
      PID:16928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3433.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        6⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        5⤵
        
        PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        5⤵
        
        PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
      4⤵
      PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
      4⤵
      PID:14824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
    3⤵
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22538.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
      4⤵
      PID:14100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
      4⤵
      PID:16980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
    3⤵
    PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
      4⤵
      PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
    3⤵
    PID:9796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
    3⤵
    PID:12740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
    3⤵
    PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
    3⤵
    PID:17324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38883.exe
      4⤵
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        6⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4208.exe
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
        5⤵
        
        PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40602.exe
        5⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43809.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
      4⤵
      PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
      4⤵
      PID:10996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
    3⤵
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        5⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        5⤵
        
        PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36698.exe
      4⤵
      PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
      4⤵
      PID:15972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
    3⤵
    PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62650.exe
      4⤵
      PID:11560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
      4⤵
      PID:8452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
    3⤵
    PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
    3⤵
    PID:12840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
    3⤵
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
    3⤵
    PID:9896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
    3⤵
    PID:17060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
    3⤵
    PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        6⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        5⤵
        
        PID:11280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        5⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        5⤵
        
        PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
      4⤵
      PID:14068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
      4⤵
      PID:9944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56728.exe
      4⤵
      PID:12732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
      4⤵
      PID:16784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
    3⤵
    PID:9524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
    3⤵
    PID:12520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
    3⤵
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
    3⤵
    PID:9828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
    3⤵
    PID:16824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
  2⤵
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12082.exe
    3⤵
    PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
      4⤵
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16026.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        5⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        5⤵
        
        PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
      4⤵
      PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
      4⤵
      PID:15936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
    3⤵
    PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
    3⤵
    PID:11812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
    3⤵
    PID:15604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
    3⤵
    PID:9720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
    3⤵
    PID:8020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
  2⤵
  PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
    3⤵
    PID:7944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
    3⤵
    PID:11404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23376.exe
    3⤵
    PID:14244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
    3⤵
    PID:9084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
  2⤵
  PID:7920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
  2⤵
  PID:10404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49257.exe
  2⤵
  PID:16028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3784 -ip 3784
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3196 -ip 3196
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 720 -ip 720
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3740 -ip 3740
1⤵
PID:7652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2036 -ip 2036
1⤵
PID:7712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2844 -ip 2844
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 9144 -ip 9144
1⤵
PID:15088

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe

Filesize
468KB

MD5
8f49910f0b676b18542680b43e0c4630

SHA1
9cebb55978d22ab922e4382d102e82fd41bccb79

SHA256
a621d1662666dcf1b37ce431010295f572b48b180b5ec4d095f5215fd35c668b

SHA512
483716f20fa061325d6da299b506bb781617a53f355e37bd2fa1f34369382cdff1a03f8e31b71df073bcabf4b66d0b20caa050daac29f3bd94f3d7b9850e8852

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe

Filesize
468KB

MD5
f3306f2bbf39778e26663ba1cc7833e7

SHA1
608a7c6c745239626a3513047be17e396e663bbe

SHA256
6b4402c2fe3e95d78af5ea498d32a7ceadda9750ca1212c10fe4ff6179863c07

SHA512
c24170f3ab33ea80f6f4817148877045287bc22c5fdf9339fabce7421bdd822eccb0af9cdfed1d4f7fe818c66f038d1efc1b7968c00a0695a26e45677924e052

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe

Filesize
468KB

MD5
8a73c6324d44f3b1b4a1f1e54e3a9f46

SHA1
9ce198868c84cc1af333649e9d067b8476abe241

SHA256
3bf9db8f3defac784ea245577ac90a04258702ccfc010d29924ce842f420e378

SHA512
660cf99a22d2b781f31a96a3756606d7161c1099588a6794bd030923f966e0201aeb2d99554043877d1b195d7484d90a433ce487ab88c087d76f7e04590c8e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe

Filesize
468KB

MD5
f5c5384425c84e3c95c471543c52416b

SHA1
f4dc49de1cb6bd0358c9525ee78fc690b01dff4d

SHA256
4800e605db9d374cc9c1834d019a2eeef8c0812fa3c768ff83956839b1939b29

SHA512
43b818b26036da194fdaa12bc2442c52c1565616158929f9830081e20e612d79f6cddab89758b32e8b7c29630703ff1f0c17aa50ce7493fcc5790285458a184f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe

Filesize
468KB

MD5
ce3cd6fe76a3594b85a7de21be6a2043

SHA1
2120c1c0854c8a04d1ba12c3d750829ad90351c9

SHA256
82e74194d8859b52d6f6fa002f398543e9ee8ab2dc3379ede601c5aaddead98e

SHA512
ad9f4bbcc5db58e0c8fc1d238578ef9d2a6057946ab6af0b4874c8c6b4d924c80c24f898f63d25ede8cbbebcf34c8d6f9f3bdc2c9c25eb9003b4f3e6d1829eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe

Filesize
468KB

MD5
d11e01fcf3831f75e0f0fd4700aa1d02

SHA1
233c21347895922906ee1f09a6c3098e1f230c2e

SHA256
6591c146388549688d45a1f6c29e3b6827c09654fef795a2039131ab60a5d7a2

SHA512
ce513d669c28dd694737426b2b405c49dd1c0b8aa14d4ada8ef0a4dc02f1294ab634016b93900eaf315d4040031c32beeea8b012c15402eced67fb9573730016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe

Filesize
468KB

MD5
cd1688c3eab0581eaaf3bcda45ee3e39

SHA1
cdf83cad3f9458419ae37ab3790f2f38ada9df36

SHA256
7ebfc5d6793fe53091d0968d3b40bdc0d1ed541b40647dbe6cf7b07a4dbecc24

SHA512
2a54a1621c7bade54207dbfc6086065cc768a41b5c318e4d4ff1e78491554a8288e0bd786c7258723a9d0d0894d86da8ab02937818f17ee07e49e349bae0bf73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe

Filesize
468KB

MD5
9fa16b450b5adaf37dce0467de86ce0d

SHA1
4b0321fd52774f7a983b8923dcb1989f5440fc95

SHA256
6207e27eb7c60c920309015aa9d6a5603ee54faeadf218cf827f693023443f4c

SHA512
c87c9a5ce3474c3c52d2991d9342fb9a169ffbb02f245ede1ed8b2254362967a276a7ed05560b6a4083b4e9b1cd7bfe6afd8682465643fb639066d49d690e1cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26563.exe

Filesize
468KB

MD5
191e021248f0a0ce40f3c411b3076d4c

SHA1
66b929ca7d1f9e46d3885f114e13dd46373051a1

SHA256
70224c625491613937cb77365dfb1bcf3472bf2fc08ab0df6dfd1daa23779643

SHA512
e0b2f393ab2f8ffac79625dac697d7a9e1204246dee0108f28322a4aaca93d05343fdd6350dc67b565773c5460292e93d9de2aa210d29ce24f45737f9b3e7df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe

Filesize
468KB

MD5
fd1d6a4b25f9f0f7d6f5662ab2cfd71b

SHA1
729601ea4075902c29e60bdc80240bdca98d8701

SHA256
f0f5250f47744c2ab46d99f41bfcde66adcaff98a63dddc1cddad15733b4ef2c

SHA512
0dfa48567dc3905efb694d17ad0a4737ad85b4752ebc3d9f28a3f17e8462bb814d52f1a8906a5f69851379e65d090eed7a676b5f0c44332b2297e9d167c43348

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe

Filesize
468KB

MD5
afb19401637973567001abe95c78ba17

SHA1
dd7a1e56cffded59fba015ff6317d5b73bc31094

SHA256
6b1d4d4155b72a0fc98e9c891e7470732c75d3e40ab5d9efef5d277044e45356

SHA512
a620d33e094045b3bc1278ae5fbf3a30257c3f11a48f6c3883b8859434bf55c7ae5f0071b4b9381cec7421d07a874bb92edec14a95ce90f4137a344608090a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe

Filesize
468KB

MD5
b6f28d38c73febd184e653a7f26301cb

SHA1
947560d400ecdcfdcb42940ce7eb3528bc002449

SHA256
42a87ef1e51181511ad9b16ce9fe6ac7549143ca671183b7a7d7f5136c5c6603

SHA512
25d72a0b9c1fec5a355cc9088da64f0c80119ada7bdae3cb9e1e52e34262b55a1d53bb173ea2f9a39ea73251846f766a6e1ed1cf687ecee02e58d0bc6d0d229b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe

Filesize
468KB

MD5
85a4bd037927d67b64581ad7ecc6151c

SHA1
d1a09cea7fc3d1c6207512a40b6a6218696f6aa6

SHA256
1f96bc15bfa093d8b5b5e5a18c35189e3539d19f86cdfc9512e2724c177a4c15

SHA512
d9f1e3ecb431d50001bf366366b2d55077fd30988ca060a1843e63020eb288ac9ccdc1391fcf34e565036ded1ee8b31fff550b2bbdc4dccf7206bff589aa9674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe

Filesize
468KB

MD5
dc61b2fd8678d2de3c0d553eca7203f3

SHA1
a80c11a1165a709f14bdb804c18f7af105b960fc

SHA256
2ee38a3d27f2941bf2975503e78b8e9bca7e90f0af7bdc9c2092a115150e8d2c

SHA512
fc97420f01eb1c47b400d64581eae818e21464d7eea671b295f7199f5ab91dff32be23329d2fb26bda5fe3c6a00625538f667df57f17a8790005db6b784ae443

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe

Filesize
468KB

MD5
b32ff952ee4c17134c8ee60f2a7e4a3b

SHA1
2b3149caa95c43b7a3a15efaaec4dd5f60e3b736

SHA256
b0e8792e415318856bb91d705e8583316301e552e97969775d0ffa217b6fa143

SHA512
78aa96680964215efae8436817270583d5277973cbd694830287192b629d23ab7226ebcaad4dce32932cc005c899c76478374762c7f98a3a63d591eea5b11229

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe

Filesize
468KB

MD5
a6fb048d5acd29d3a642bd166c412fc5

SHA1
e84e013cd5a0002e91e163b884889284c827377d

SHA256
310e8cf5b5b3cf13353a8b4d9539d22e10b00bca65a107bc9092b5fb6e2ebaef

SHA512
6d0024de3185a8e2a14012ccb020b788f95a1c3f3c83310c68b4ccca6c1d514b6d8508f1e44ef914d60af49c2bede043f3773332e64dd3baf958e06d1369ee37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe

Filesize
468KB

MD5
cbf3e66eee6ee7b97dbea7576710c43c

SHA1
48c9dd23fca0e03bbf7b44f67a41b5ea99771182

SHA256
12856b6f9f3ee06180f7ae6c1819cc660d9853098e959c2623a56c85ac59dd9e

SHA512
ec197887905684ee650e34ba6c18abe21057ea9628863d100bdd7590e06a19b638102eeee9faf1d85c1c12b0d0e41dcb7b36029443d79bb3cbb6be7bab2f1240

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe

Filesize
468KB

MD5
c9e15fa52c436e75a6aa4864b4167a0d

SHA1
a4106fb4f186019f696f1e82243b2a6486022c32

SHA256
01e51c8b74c7997030ed9478566d6daa073375ada48fcd67e4314a37c96da47b

SHA512
007c71cd91632a86274f66ec220b8e08df6b3e4e2a33fd7ad67152114433c0cc68eaeffd19d239cc1d1f6e3a6e8f44df2ef926a6deeea554698d243971574690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe

Filesize
468KB

MD5
433e6a0b19ace3765f7a666299215168

SHA1
d721fb4b37a1828b1ba962bc5c5f26d60fb32f06

SHA256
0703a71e236b7833c0a1b5a8f1f12cb67674de8d03a68d4a6614166350b68b63

SHA512
57cf4628e4093f98d85d0ff97f46dbb20d346ccf08c3e24b002253b8c23d90b3e9a4294fd97a81db1f791416458fd92d684687459aeec6cc529d89b99e2855d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44995.exe

Filesize
468KB

MD5
aa5b46eb2662e9290bb7417a488b2fc3

SHA1
91fd9eb62a2bf33efa82893eab0f2e720cb1bcad

SHA256
7298a51b856f9bbd1fab78f3a86386a160382eb2095fcc1e626ab8fe268df8c0

SHA512
76e5bf520d3d17c50b7756b3b915bf099d173a4068491ffddb802a6c60bfeacd637496e1dc42ded57e186128db7c3790c43218ee499373429f1ce2badd671d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46888.exe

Filesize
468KB

MD5
b5d2f3d797f5754eebad63f81a968ad3

SHA1
cfb1e209c349531539c7709ac858f5b4eb34f753

SHA256
b199ab3b3abfe6aa86278ab36db393117ecdbf781e77b92f0b90aba4879b1b8a

SHA512
90832211e5162c80e1494fc134185413bf7a0fe6405aae2dc27a22e6aeed17a8a9ed5ef4f025c5bc7aa6fdbfc328b868357c60caa5329f23bcce92a2a8b44092

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48913.exe

Filesize
468KB

MD5
8d2af3e1f63150c0d95c927b9f1e97b6

SHA1
5f2d9e83c7c12b4029eb6f595fa2724aa8cb4320

SHA256
5fadb4a30f4047136e69133a2a40e0f0db3600525fe6d93ed8c498045c74a86c

SHA512
cc203a5dc6a2a0338a82903fa56da5914ac5dc221906286aca0dfa9bce83ee88311cc54b7a2a44dcb1798f0e3163bda3b80aa27d94ca6c5714477239e29649ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe

Filesize
468KB

MD5
1942d9b890886613b3b46576c7725293

SHA1
0ab11130317aeed1da57bee5d0f64eeaf9c6c5e1

SHA256
8cdf717623fdfd235099c646866fecb3a9c8d2f207cf40781ad554e5a7ea86b7

SHA512
1a55b0d5b3d58117cd20630532f8f5b1b225b9d2ad3b8178496b63878f201ea9218dd4f3d413b4a045fa4d286b1b468f13ec620459e1cd666fd1e71b57fb6f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe

Filesize
468KB

MD5
f91bfab256951e0303c8a414390ce25b

SHA1
42bb144a28992af89e854fef1e1fbfd2ec4ca70b

SHA256
f52470dbeb8a263c7a21ef0bddc7591ddfbb75dbc7a75f3e6d8e3bd3f009a55c

SHA512
a015b0dd91176eca7e54030b439078401547cf89e4992d0a921171bb452a78eae10000f7b9f957fd7ce006aad9061012c3ad9979090a06a5f39a7f99aafebed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe

Filesize
468KB

MD5
3d119ea5ab6a456a922204efe666b783

SHA1
ae94a9a3271b57e3e229d093018805bd0fbe5156

SHA256
9ff4831404afebba58cb4271b1c92bb8d740d6598ec4d0b62a627bd752894589

SHA512
82afd5886b548b69a71b0201f75c6727662d50d35b4fc45f53fad209c4e4f50338f88f8a22ba7325812c17608e4c047620af2930f157f22b445b50c093f342fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe

Filesize
468KB

MD5
66ed77680c5f3a20fe04928d1ab60383

SHA1
dba7e2b3979a29e9101de13b00fc160c2b561a43

SHA256
42d639774196bb2791fcf2a50ae7fd2c51331a46e833fb1cf1de30658b77d642

SHA512
346957fe835f70a139ddd58e0fa894339487c1a2f06ddeb49242808f9caf3a8dad518b39d672181bd0ee57e0de2c5bdbbfa9165432e53384f9c0c76774a4aef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe

Filesize
468KB

MD5
113e558f22c7016eda836dc966abddf1

SHA1
e4d010bd7cbc9e1b7b1202a76b98b657d646beaa

SHA256
9093ee7fee1820ca32eeebe19fdd1cd1277e90e587dfc02f00c7f7dd14f3d9c7

SHA512
8961a3953bfcf8472b042a1318a977b01cd646e42df8b0fe7526fa174389e7993e96a2fa4c4679f0c9545d2b121536ed6f766e3c6378577c8a7055e0fee8c99b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe

Filesize
468KB

MD5
5c2e57175788e56a0d666ce0a7cce872

SHA1
67a9ca001ed0631f2be586f7abd120f42d83d707

SHA256
7dffe83b17d1c1d333ac4db69e53a538f5b76b3a695ad9da5881050715811bf7

SHA512
ca9ffe7272b2d6bf7813046050094a49fb7f23da377f4b221bafaf8881f9f1146a6d2d4cd2ea19d4d3360c577efb00e7d9bbbd0915bf6bfa478ae2325439ff6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe

Filesize
468KB

MD5
d3f80c87d1e632b1c89896ad82a356ce

SHA1
56d14bd32e6634a109f3c999450ac8561f1a0430

SHA256
982e1cb62f0e4db9b309c9f14bb4f09ed1d00d081ac48cbcee834899fe38a76d

SHA512
6578add778597d87f9e3036f3016b9c9a327dc64728141c345c06885a5a591f4f09ee215a556a4b4389d272d2d5457ce1de1b33fb2d99fbaec70c2fdc334f0c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe

Filesize
468KB

MD5
fbbc3ea5e682628b3a70f7b7b9879d24

SHA1
cafc8fa905219fee36367093ff05c8b3dd9bd456

SHA256
a040cd84a5bcc058ca3526482a3cd5e78c0aeef68687dc041272e48e00a6df98

SHA512
4cba86eb00e45c841f6e6e29f245336a02a0faf0a72f09c17ea206aa75c1c2086946ff15825888db535076a510b3253094f9891937ec5ebe5ff0b848661307b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe

Filesize
468KB

MD5
61315b780af94f8fcca0ba93fe68f406

SHA1
0eea5c3788e03eeafb5cabbf7fe24ea7ee9c115f

SHA256
5473a9f221c3bb5a107d0bd53cab118e3233429b117d857012e75a21265131dd

SHA512
24c6193e4850b5019fe0f60fce365bb1b0ab86e0bceb0c80773dd66c24834af2fb75aec1003af5e7fdeda441ce705209163b9a6263ca4adc4ed1c4a1040701de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe

Filesize
468KB

MD5
932bbd408448c93589aed15e2da1e730

SHA1
09484b3533ad3a4adca44e9093364261aefd015d

SHA256
685a3c36a9a66538540e3ebb45399952b479c25a357467cdabed2e0bdb920503

SHA512
8cf12bf2f452eef4daef57d00ace7692381ca366bd3502025659953cc6319a87fb6dc592c93830f454787ea8237e3736f0703002f8be0ca41122af141271d633

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe

Filesize
468KB

MD5
b26df7a916e5e5953283015280ebd8f7

SHA1
683e94a829e979c6e6b41fd99d4261ffa76bbdf6

SHA256
1e74e672353637f41e0133c507ecde3feac48e719c4cfd3db3dde9a18237affc

SHA512
fece690b48a7bc6d4fa8d1cf7912607c3954f785e1397aac0790761eedd558591449160bbf10cee74fe1323181345a216a30ae8e0ff95f25c8b01305f1dec480

Download Submit
memory/384-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/720-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-2562-0x0000000075270000-0x0000000075299000-memory.dmp

Filesize
164KB

Download
memory/1264-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3272-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-2561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-3686-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3556-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-847-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4128-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4168-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6828-4144-0x0000000075BC0000-0x0000000075C7F000-memory.dmp

Filesize
764KB

Download
memory/6828-4142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6976-3184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7428-4195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7604-3704-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9864-4569-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10200-3458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11556-3542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11764-3593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11860-4197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13040-4187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13356-3734-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14176-4419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14256-4086-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16660-3649-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16784-3727-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16876-3610-0x0000000077BD0000-0x0000000077BDA000-memory.dmp

Filesize
40KB

Download
memory/16940-3701-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads