46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe
Size

468KB
MD5

63ba1edf24e56dac1348fd728b99c760
SHA1

9ef4f4ab7f88c4129d31d59ee87b037d565a2aee
SHA256

46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab
SHA512

44d981225a55dede81e8a5b31a5174e67e702cff962f51a5560782afe926022bbede15c3321d33f88f7c4cba4993c3d3f1e26154d22d8e09cc1cf7a19f2cd6b5
SSDEEP

3072:yb/0ovITyq5/tbYzPgGLOfN/zChSJIpXHmHevSwxux0wvrnuS6lT:yb8oJu/tcPXLOf/0BhuxxDnuS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4892	Unicorn-42824.exe
1296	Unicorn-33800.exe
4324	Unicorn-13934.exe
2444	Unicorn-42744.exe
4628	Unicorn-11917.exe
4136	Unicorn-47383.exe
3624	Unicorn-1711.exe
4056	Unicorn-49983.exe
2496	Unicorn-4311.exe
4696	Unicorn-37368.exe
2292	Unicorn-974.exe
4212	Unicorn-31237.exe
2644	Unicorn-37368.exe
2848	Unicorn-37368.exe
948	Unicorn-20574.exe
4556	Unicorn-13351.exe
4020	Unicorn-13351.exe
4268	Unicorn-17030.exe
2348	Unicorn-30765.exe
2796	Unicorn-45640.exe
2000	Unicorn-29304.exe
4448	Unicorn-4607.exe
4880	Unicorn-50279.exe
5048	Unicorn-53808.exe
1748	Unicorn-61214.exe
224	Unicorn-38935.exe
5044	Unicorn-19334.exe
404	Unicorn-52007.exe
3028	Unicorn-22864.exe
1644	Unicorn-39200.exe
4108	Unicorn-16733.exe
4372	Unicorn-49672.exe
2252	Unicorn-5302.exe
3268	Unicorn-5302.exe
2040	Unicorn-25168.exe
3368	Unicorn-41888.exe
3560	Unicorn-25552.exe
2684	Unicorn-8758.exe
3704	Unicorn-2893.exe
1872	Unicorn-23352.exe
4828	Unicorn-61047.exe
3792	Unicorn-15375.exe
1288	Unicorn-44519.exe
3456	Unicorn-55832.exe
4520	Unicorn-18757.exe
4792	Unicorn-24888.exe
4256	Unicorn-25080.exe
2016	Unicorn-29526.exe
2180	Unicorn-21550.exe
2284	Unicorn-383.exe
2184	Unicorn-33175.exe
636	Unicorn-33440.exe
2148	Unicorn-24509.exe
4884	Unicorn-5406.exe
3000	Unicorn-27309.exe
3060	Unicorn-17104.exe
4336	Unicorn-2613.exe
1056	Unicorn-48814.exe
3520	Unicorn-46247.exe
2044	Unicorn-44296.exe
3516	Unicorn-60632.exe
2004	Unicorn-60632.exe
4992	Unicorn-62862.exe
3088	Unicorn-16646.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4952	2000	WerFault.exe	116
7236	2148	WerFault.exe	148
6944	5436	WerFault.exe	187
10716	5796	WerFault.exe	197
9232	2148	WerFault.exe	148
12176	5796	WerFault.exe	197
12952	7860	WerFault.exe	321
1120	7860	WerFault.exe	321
18296	7852	WerFault.exe	320
16952	5208	Process not Found	908

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6656	dwm.exe
Token: SeChangeNotifyPrivilege	6656	dwm.exe
Token: 33	6656	dwm.exe
Token: SeIncBasePriorityPrivilege	6656	dwm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4896	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe
4892	Unicorn-42824.exe
4324	Unicorn-13934.exe
1296	Unicorn-33800.exe
2444	Unicorn-42744.exe
4628	Unicorn-11917.exe
4136	Unicorn-47383.exe
3624	Unicorn-1711.exe
4056	Unicorn-49983.exe
2496	Unicorn-4311.exe
2292	Unicorn-974.exe
4696	Unicorn-37368.exe
4212	Unicorn-31237.exe
948	Unicorn-20574.exe
2644	Unicorn-37368.exe
2848	Unicorn-37368.exe
4020	Unicorn-13351.exe
4556	Unicorn-13351.exe
2348	Unicorn-30765.exe
4268	Unicorn-17030.exe
2796	Unicorn-45640.exe
4448	Unicorn-4607.exe
2000	Unicorn-29304.exe
4108	Unicorn-16733.exe
5044	Unicorn-19334.exe
3028	Unicorn-22864.exe
4880	Unicorn-50279.exe
224	Unicorn-38935.exe
1644	Unicorn-39200.exe
1748	Unicorn-61214.exe
404	Unicorn-52007.exe
5048	Unicorn-53808.exe
2252	Unicorn-5302.exe
4372	Unicorn-49672.exe
3268	Unicorn-5302.exe
2040	Unicorn-25168.exe
3368	Unicorn-41888.exe
3560	Unicorn-25552.exe
3704	Unicorn-2893.exe
2684	Unicorn-8758.exe
1872	Unicorn-23352.exe
4828	Unicorn-61047.exe
3792	Unicorn-15375.exe
1288	Unicorn-44519.exe
3456	Unicorn-55832.exe
4792	Unicorn-24888.exe
4520	Unicorn-18757.exe
4256	Unicorn-25080.exe
2016	Unicorn-29526.exe
2180	Unicorn-21550.exe
2284	Unicorn-383.exe
2184	Unicorn-33175.exe
2148	Unicorn-24509.exe
4884	Unicorn-5406.exe
1056	Unicorn-48814.exe
636	Unicorn-33440.exe
3000	Unicorn-27309.exe
4336	Unicorn-2613.exe
3060	Unicorn-17104.exe
3520	Unicorn-46247.exe
2044	Unicorn-44296.exe
2004	Unicorn-60632.exe
3516	Unicorn-60632.exe
3088	Unicorn-16646.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4892	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	89
PID 3248 wrote to memory of 4892	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	89
PID 3248 wrote to memory of 4892	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	89
PID 4892 wrote to memory of 1296	4892	Unicorn-42824.exe	94
PID 4892 wrote to memory of 1296	4892	Unicorn-42824.exe	94
PID 4892 wrote to memory of 1296	4892	Unicorn-42824.exe	94
PID 3248 wrote to memory of 4324	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	95
PID 3248 wrote to memory of 4324	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	95
PID 3248 wrote to memory of 4324	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	95
PID 4324 wrote to memory of 2444	4324	Unicorn-13934.exe	97
PID 4324 wrote to memory of 2444	4324	Unicorn-13934.exe	97
PID 4324 wrote to memory of 2444	4324	Unicorn-13934.exe	97
PID 3248 wrote to memory of 4628	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	98
PID 3248 wrote to memory of 4628	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	98
PID 3248 wrote to memory of 4628	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	98
PID 4892 wrote to memory of 4136	4892	Unicorn-42824.exe	99
PID 4892 wrote to memory of 4136	4892	Unicorn-42824.exe	99
PID 4892 wrote to memory of 4136	4892	Unicorn-42824.exe	99
PID 1296 wrote to memory of 3624	1296	Unicorn-33800.exe	100
PID 1296 wrote to memory of 3624	1296	Unicorn-33800.exe	100
PID 1296 wrote to memory of 3624	1296	Unicorn-33800.exe	100
PID 4324 wrote to memory of 4056	4324	Unicorn-13934.exe	102
PID 4324 wrote to memory of 4056	4324	Unicorn-13934.exe	102
PID 4324 wrote to memory of 4056	4324	Unicorn-13934.exe	102
PID 2444 wrote to memory of 2496	2444	Unicorn-42744.exe	103
PID 2444 wrote to memory of 2496	2444	Unicorn-42744.exe	103
PID 2444 wrote to memory of 2496	2444	Unicorn-42744.exe	103
PID 3624 wrote to memory of 4696	3624	Unicorn-1711.exe	105
PID 3624 wrote to memory of 4696	3624	Unicorn-1711.exe	105
PID 3624 wrote to memory of 4696	3624	Unicorn-1711.exe	105
PID 1296 wrote to memory of 2292	1296	Unicorn-33800.exe	107
PID 1296 wrote to memory of 2292	1296	Unicorn-33800.exe	107
PID 1296 wrote to memory of 2292	1296	Unicorn-33800.exe	107
PID 4892 wrote to memory of 4212	4892	Unicorn-42824.exe	104
PID 4892 wrote to memory of 4212	4892	Unicorn-42824.exe	104
PID 4892 wrote to memory of 4212	4892	Unicorn-42824.exe	104
PID 4628 wrote to memory of 2644	4628	Unicorn-11917.exe	106
PID 4628 wrote to memory of 2644	4628	Unicorn-11917.exe	106
PID 4628 wrote to memory of 2644	4628	Unicorn-11917.exe	106
PID 4136 wrote to memory of 2848	4136	Unicorn-47383.exe	109
PID 4136 wrote to memory of 2848	4136	Unicorn-47383.exe	109
PID 4136 wrote to memory of 2848	4136	Unicorn-47383.exe	109
PID 3248 wrote to memory of 948	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	108
PID 3248 wrote to memory of 948	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	108
PID 3248 wrote to memory of 948	3248	46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe	108
PID 2496 wrote to memory of 4020	2496	Unicorn-4311.exe	111
PID 2496 wrote to memory of 4020	2496	Unicorn-4311.exe	111
PID 2496 wrote to memory of 4020	2496	Unicorn-4311.exe	111
PID 4056 wrote to memory of 4556	4056	Unicorn-49983.exe	112
PID 4056 wrote to memory of 4556	4056	Unicorn-49983.exe	112
PID 4056 wrote to memory of 4556	4056	Unicorn-49983.exe	112
PID 2444 wrote to memory of 4268	2444	Unicorn-42744.exe	113
PID 2444 wrote to memory of 4268	2444	Unicorn-42744.exe	113
PID 2444 wrote to memory of 4268	2444	Unicorn-42744.exe	113
PID 4324 wrote to memory of 2348	4324	Unicorn-13934.exe	114
PID 4324 wrote to memory of 2348	4324	Unicorn-13934.exe	114
PID 4324 wrote to memory of 2348	4324	Unicorn-13934.exe	114
PID 2644 wrote to memory of 2796	2644	Unicorn-37368.exe	115
PID 2644 wrote to memory of 2796	2644	Unicorn-37368.exe	115
PID 2644 wrote to memory of 2796	2644	Unicorn-37368.exe	115
PID 948 wrote to memory of 2000	948	Unicorn-20574.exe	116
PID 948 wrote to memory of 2000	948	Unicorn-20574.exe	116
PID 948 wrote to memory of 2000	948	Unicorn-20574.exe	116
PID 4212 wrote to memory of 4448	4212	Unicorn-31237.exe	119

C:\Users\Admin\AppData\Local\Temp\46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\46758affd573da35c0becb062874f1f66f2ffb2e1fd3040606c604dd89e9d0ab_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        9⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        10⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        10⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
        9⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        9⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        9⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        9⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        10⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        10⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        9⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        8⤵
        
        PID:19000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        9⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38963.exe
        9⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18242.exe
        8⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        8⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        8⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exe
        7⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        9⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
        9⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37707.exe
        9⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
        8⤵
        
        PID:19920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        8⤵
        
        PID:18976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        7⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        8⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57740.exe
        8⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        8⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        8⤵
        
        PID:19260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        7⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        7⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        6⤵
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        6⤵
        
        PID:18624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55832.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59496.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        9⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        10⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        10⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        9⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        9⤵
        
        PID:19532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        8⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        8⤵
        
        PID:20476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        8⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        8⤵
        
        PID:18596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        7⤵
        
        PID:18868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38182.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        8⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        8⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        7⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        7⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        6⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39276.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        6⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
        6⤵
        
        PID:19452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        9⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        9⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        8⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        8⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        7⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        8⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        8⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        8⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13666.exe
        7⤵
        
        PID:18768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        6⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        7⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        7⤵
        
        PID:18484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exe
        6⤵
        
        PID:17256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        6⤵
        
        PID:18920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17518.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        7⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        7⤵
        
        PID:17680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-547.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        6⤵
        
        PID:18420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35123.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exe
        5⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        5⤵
        
        PID:18576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        8⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        8⤵
        
        PID:19580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
        7⤵
        
        PID:19476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        6⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30434.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe
        6⤵
        
        PID:18848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        8⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        7⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        6⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        6⤵
        
        PID:19080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        7⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        6⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        7⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38035.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        6⤵
        
        PID:18900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        6⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
        6⤵
        
        PID:18452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        5⤵
        
        PID:17640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        8⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        8⤵
        
        PID:19204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46175.exe
        6⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
        7⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        7⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
        6⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        6⤵
        
        PID:19160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        5⤵
        
        PID:18368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        7⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42.exe
        7⤵
        
        PID:19076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        6⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        6⤵
        
        PID:20060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        5⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27963.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        6⤵
        
        PID:18464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-162.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26338.exe
        5⤵
        
        PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        6⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        6⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        5⤵
        
        PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4534.exe
      4⤵
      PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        5⤵
        
        PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
      4⤵
      PID:15568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
      4⤵
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        8⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        9⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        9⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        9⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        8⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe
        8⤵
        
        PID:19104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        8⤵
        
        PID:18828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        7⤵
        
        PID:20392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        6⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 632
        7⤵
        Program crash
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42227.exe
        8⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        7⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63588.exe
        6⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        7⤵
        
        PID:19520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        7⤵
        
        PID:18528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62006.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49572.exe
        7⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        6⤵
        
        PID:19216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
        5⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
        5⤵
        
        PID:18496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10783.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        9⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        9⤵
        
        PID:17444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        8⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        6⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        7⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        7⤵
        
        PID:19152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        7⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52092.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21466.exe
        6⤵
        
        PID:20464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        5⤵
        
        PID:17692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        7⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        6⤵
        
        PID:18740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        5⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61069.exe
        5⤵
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        5⤵
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        6⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        6⤵
        
        PID:19928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21947.exe
        5⤵
        
        PID:18648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
      4⤵
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
      4⤵
      PID:17696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15375.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        6⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        8⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        9⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41507.exe
        9⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        9⤵
        
        PID:19908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22820.exe
        8⤵
        
        PID:19640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        8⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        8⤵
        
        PID:20576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        8⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        8⤵
        
        PID:18552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10355.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe
        7⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
        7⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43574.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        5⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        8⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12779.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
        8⤵
        
        PID:19196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
        7⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        6⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36971.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        5⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        5⤵
        
        PID:18612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        5⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        8⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        7⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        6⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
        7⤵
        
        PID:19876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55760.exe
        6⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
        7⤵
        
        PID:18812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        5⤵
        
        PID:13976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
      4⤵
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        6⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23427.exe
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        5⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        5⤵
        
        PID:18800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        5⤵
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        5⤵
        
        PID:18356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
      4⤵
      PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
      4⤵
      PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe
      4⤵
      PID:18960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38935.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11268.exe
        8⤵
        
        PID:18120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        7⤵
        
        PID:18192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        6⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
        5⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16219.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        5⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
        5⤵
        
        PID:20132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
      4⤵
      PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        5⤵
        
        PID:412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
      4⤵
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        6⤵
        
        PID:10212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7860 -s 652
        6⤵
        Program crash
        
        PID:12952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7860 -s 652
        6⤵
        Program crash
        
        PID:1120
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 636
        5⤵
        Program crash
        
        PID:10716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 636
        5⤵
        Program crash
        
        PID:12176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 624
      4⤵
      Program crash
      PID:7236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 684
      4⤵
      Program crash
      PID:9232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
    3⤵
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35598.exe
      4⤵
      PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52125.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
        5⤵
        
        PID:18952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
      4⤵
      PID:10372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      4⤵
      PID:15576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
      4⤵
      PID:19440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
    3⤵
    PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
      4⤵
      PID:10700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
      4⤵
      PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
      4⤵
      PID:18604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
    3⤵
    PID:11240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62132.exe
    3⤵
    PID:11512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
    3⤵
    PID:19552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49672.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        9⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        10⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        10⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        9⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        9⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29838.exe
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        8⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        8⤵
        
        PID:18108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        9⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        9⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        8⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        8⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1891.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        7⤵
        
        PID:18856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        6⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44208.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        8⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33989.exe
        9⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        9⤵
        
        PID:19120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        8⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18683.exe
        7⤵
        
        PID:17812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13663.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exe
        8⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53163.exe
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16219.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
        7⤵
        
        PID:19656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19227.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
        9⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        9⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        9⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        9⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
        8⤵
        
        PID:18944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        8⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        8⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12779.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        8⤵
        
        PID:18316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        7⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59910.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        5⤵
        Executes dropped EXE
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
        8⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        8⤵
        
        PID:17536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52348.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        7⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
        7⤵
        
        PID:17612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        6⤵
        
        PID:19588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
        5⤵
        
        PID:19976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        6⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        9⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        9⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        9⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        8⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29838.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe
        8⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        8⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        7⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        7⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        8⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55668.exe
        8⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        7⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59910.exe
        6⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        5⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        8⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        8⤵
        
        PID:21392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
        7⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        6⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        6⤵
        
        PID:19484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        6⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        7⤵
        
        PID:18540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        5⤵
        
        PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        5⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        8⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        6⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45275.exe
        7⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8198.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        7⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24579.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        5⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        6⤵
        
        PID:18984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
      4⤵
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4372.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        7⤵
        
        PID:20108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        6⤵
        
        PID:19136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38198.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58564.exe
        5⤵
        
        PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49572.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        5⤵
        
        PID:17432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
      4⤵
      PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
      4⤵
      PID:18692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49983.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53144.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15095.exe
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        9⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        9⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        9⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exe
        9⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        8⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        8⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        8⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        7⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        8⤵
        
        PID:18364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
        7⤵
        
        PID:19692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        6⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8668.exe
        7⤵
        
        PID:19796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        6⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        7⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        7⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        5⤵
        
        PID:11892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        6⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46619.exe
        7⤵
        
        PID:18524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        6⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35406.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30381.exe
      4⤵
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        6⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63276.exe
        5⤵
        
        PID:19172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        5⤵
        
        PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
      4⤵
      PID:9280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51845.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7827.exe
        5⤵
        
        PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
      4⤵
      PID:14216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
      4⤵
      PID:19672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        5⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        8⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41371.exe
        8⤵
        
        PID:19092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13339.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        6⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1684.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        7⤵
        
        PID:17588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        5⤵
        
        PID:19892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
      4⤵
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
        7⤵
        
        PID:19300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        5⤵
        
        PID:18716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        5⤵
        
        PID:10852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
      4⤵
      PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
      4⤵
      PID:18756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8758.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
      4⤵
      PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        6⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        7⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        6⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
        5⤵
        
        PID:12364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
      4⤵
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        5⤵
        
        PID:18636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
      4⤵
      PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
      4⤵
      PID:14868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11437.exe
    3⤵
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        5⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14251.exe
        6⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
      4⤵
      PID:15080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
      4⤵
      PID:17836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
    3⤵
    PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
      4⤵
      PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        5⤵
        
        PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
      4⤵
      PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
    3⤵
    PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
      4⤵
      PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
    3⤵
    PID:12660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
    3⤵
    PID:1356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        6⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        8⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        8⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        8⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        7⤵
        
        PID:18340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        7⤵
        
        PID:19604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
        6⤵
        
        PID:20304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        6⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        7⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        8⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        8⤵
        
        PID:19180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        7⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        6⤵
        
        PID:19944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        6⤵
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44268.exe
        5⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35051.exe
        5⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61047.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        5⤵
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        6⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        8⤵
        
        PID:20296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
        7⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
        7⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        6⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
        6⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13059.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        5⤵
        
        PID:18788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        5⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        6⤵
        
        PID:19508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
      4⤵
      PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
      4⤵
      PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
      4⤵
      PID:19620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        5⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        6⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        6⤵
        
        PID:18704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      4⤵
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9058.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
      4⤵
      PID:11232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
      4⤵
      PID:17152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
      4⤵
      PID:18588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
      4⤵
      PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10708.exe
        6⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        7⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        6⤵
        
        PID:19448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21947.exe
        5⤵
        
        PID:18440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        5⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
      4⤵
      PID:14720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      4⤵
      PID:18932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
    3⤵
    PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
      4⤵
      PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
      4⤵
      PID:17660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
    3⤵
    PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
      4⤵
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
      4⤵
      PID:16264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
    3⤵
    PID:8596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
    3⤵
    PID:2388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 716
      4⤵
      Program crash
      PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        6⤵
        
        PID:19568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47643.exe
        5⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
      4⤵
      PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        5⤵
        
        PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
      4⤵
      PID:11132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
      4⤵
      PID:15032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
      4⤵
      PID:18732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
      4⤵
      PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55668.exe
        5⤵
        
        PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
      4⤵
      PID:19128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
    3⤵
    PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
      4⤵
      PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
      4⤵
      PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
    3⤵
    PID:11048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
    3⤵
    PID:14904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
    3⤵
    PID:18880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        5⤵
        
        PID:20288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
      4⤵
      PID:9364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      4⤵
      PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
      4⤵
      PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
    3⤵
    PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
      4⤵
      PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
        5⤵
        
        PID:13148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 696
        5⤵
        Program crash
        
        PID:18296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
      4⤵
      PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
      4⤵
      PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
      4⤵
      PID:18348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
    3⤵
    PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
      4⤵
      PID:15216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
    3⤵
    PID:9980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
    3⤵
    PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63436.exe
    3⤵
    PID:5756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
      4⤵
      PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
      4⤵
      PID:18564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50207.exe
    3⤵
    PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
      4⤵
      PID:9348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
      4⤵
      PID:15224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
    3⤵
    PID:9944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
    3⤵
    PID:15496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
    3⤵
    PID:18508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe
  2⤵
  PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
    3⤵
    PID:7540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
    3⤵
    PID:12356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38563.exe
    3⤵
    PID:5240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
  2⤵
  PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
    3⤵
    PID:13576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe
  2⤵
  PID:11840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
  2⤵
  PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2000 -ip 2000
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5436 -ip 5436
1⤵
PID:6660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2148 -ip 2148
1⤵
PID:7472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2148 -ip 2148
1⤵
PID:9756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5796 -ip 5796
1⤵
PID:8596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5796 -ip 5796
1⤵
PID:12016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7860 -ip 7860
1⤵
PID:13464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7860 -ip 7860
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7852 -ip 7852
1⤵
PID:18064

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe

Filesize
468KB

MD5
a0bbf909c2a4f6ce2b80ce435699b909

SHA1
dcc225fb8e6d5062058eda3034c4a4dd55b9c46e

SHA256
22df70401b3243747b6fcd27fc71b2cc6bffd8bd2e7474e0f8595511ce23b752

SHA512
753c986e2aed7f5cd513a1d00eea7a0cf8ce1e0fc651f6053d1712f449b943b97503af4ce0408b41a628cb591e64e563834a949db56405d7cadb1f87a13c1a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe

Filesize
468KB

MD5
147437f4b2a3f1b204762ca0a6e4f000

SHA1
93b541d2576e9a190f6a4ebe1ac21560c1ba1206

SHA256
a2a145745bb3aaf6c64a82dfa74ae0d1266b31e668a3ef642994c604c28008bc

SHA512
66bb3e8e6ce84393b09228ac0a0af72134ff7c0b8edcb770a28ad15a66dd9482fd8e4755bd5c694b8add14e576920f737ba18399a8cb34fc228f2929469cb00f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe

Filesize
468KB

MD5
e49d0b525f4c3b0725a6ec3c3552795e

SHA1
22677747054c8a263360c69f9def1725b97d13fc

SHA256
c02f46e76d9581926926fa7a2aac26136e205063ee33498a639d212ed84573ec

SHA512
618d111d0a14fda59d5f85685806a065f93ef493b8f521c1ebce0083f2389654886eeaa498cfeaeaf5e1958085c70504d8c161841bd343a19ed9aed11c269816

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe

Filesize
468KB

MD5
5bfda3ca978155fca2741f07a4016e77

SHA1
c2292236a316aba8ba4fbc8b1dcb807c8cdc77aa

SHA256
0370f45471a6ebe8952c8a6aa4ff9dd5edb590c35909d6b70bbaf7257e2d78fb

SHA512
83ac6dc5546e1c4d9c216f3495f9c1a5e8450e8b5f7096334b4b673b52e74212f30de8bd12f31b34f326ff14034800550300aec4ae2b662c27486cd1714cfe13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe

Filesize
468KB

MD5
062e466456226fb96cf3fc5d570e1b4a

SHA1
e41ddd95b40cbd2159c92f7e9eb86458e924e96d

SHA256
52ef12548cfbfb7153aced460b6cc7efbd4e0ccae9edae923eec709b962ca3b6

SHA512
c7579b0b2a16bc55f773bf9c7b55d3b8413a66cbc248a930fb9bd068d7b25b1f60958042aecded583c41e8a6ffbc4da4b2e005e3bf12b59ff324912b64c674c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe

Filesize
468KB

MD5
2cd8402048f4d0969b4a364445937c6c

SHA1
089a991a6eb2cb9f71b9782015bb8848244c20e1

SHA256
ee9490564fb11d07ade83d27f5da3d4e9584fddbe37cec1bcb3ee66a356fa7a6

SHA512
c864e5833253281b6a01154e3b4de6dbe020ea18d33a212095d1613419b1f31c225a46375b94d6552f82b15a3f85cd58bb7a50c7fb30f8f83cf339828a89cf00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe

Filesize
468KB

MD5
a799f4b4874798c2677d546642739c95

SHA1
0192332267f9f1f992c22b72311145fd8ac8e815

SHA256
ca75d2bb2e1f95adfe8fa52088b16168f052529955db2249c35808ff7891863f

SHA512
29c776e94909295970c4ba90bc72afa25731d0f59b46bb3688f550748f7a0585127b1cd72b9fecead4fa311fab0ebd9fe827da7b17b78b0b959fe5d45f1173e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe

Filesize
468KB

MD5
4c20222d6f18e5d89e81dd065e28fd3a

SHA1
2b427de3487a091adeb23db141bab49cb2783778

SHA256
937071bd33b4e6a164f1b6bd5f7cf669abbd5e8d70e09015870e2da2fd556bc5

SHA512
38dad78f86009e43ef32617099dad4ec13909f0d6932b3d66c538df8b4703f7d8cf38a6546bb4764e736d4d16cb6ecad5a81dfb9d7f235c677d423172c8814dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe

Filesize
468KB

MD5
693bc575de5c0f64fc7f6f3f177c6763

SHA1
5f76070823435d2afdb36e1e2ad4138dd5ffc60f

SHA256
8dedf30329289e6a90eb2bd1b7949efca0b808c5a4c72f22ec9f6c97c702ffd5

SHA512
3d515fa1826629978f92dd94918b888e96961e4a5a9fd8f3fa291c2d2fbef0808f91c48f98e5bc1c636ec8d20b52a257e2b44e9ac10c665a0a10bca81dd85400

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe

Filesize
468KB

MD5
7d7337479d26c9e2fff7473bd7f23ff5

SHA1
5262fa66f6c76533a689aeea39716c3e6876123c

SHA256
7ddc081ac630d5b99998cdff9551655518ce9ef84ffcfa18f416334956a2ca6f

SHA512
8f66623cb58a32e2ae9b88b828c4e7f8a29e81459f06919965997752f756e391ba3e0348d46f0f60f2a57907923f5a6a75d94f838e8bd44b16865975d59396d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe

Filesize
468KB

MD5
d56f38529f606dac5053815315fe43f1

SHA1
2bd439a56ad825e9f00dcc541dba1a9a41da8686

SHA256
b41ff1bfcdec1bb16ddee6a8f303632d76fe7f24ca9314d63c257a0d0555bcaa

SHA512
b6ba8bb4562bf2975fb40de859fbd5974c5f9b37b7a66a3f6af5c5696f30bb620a8a7bcaf3e66c31c359a952a524ff401fcea30d13b2d39630ca2cd848a49b20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe

Filesize
468KB

MD5
8e4b4ee1e93d4df39977ea4a1ed0cc6a

SHA1
25a9486e4d1c6375d2c7152b1e044e768fc6241f

SHA256
5a53c8f3b88141f423c6bffc810ac865c004dc850093d25911b0fa1589cbb596

SHA512
bc164cb62b4b8bcbeca99ea3a7ea63b6095981a641d2de0513150cf2f01da23a8bb909ce9de50d2d989e7ae1388da7ce1d16c2f5f13b4041303c546392776148

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe

Filesize
468KB

MD5
6e9ce94cbb2c46a49e803142030aec04

SHA1
a26d11232c6d735883e1800838b23141bf86e2aa

SHA256
446c0cd73626f45df46dd4cbf89e2808bd2e5cd0978c68015aaa46ae61e5f530

SHA512
7ca93657a5ab1f468f7427347a81374161897f7aa68371dd6670c5912bdecadbd0c67c4443cce36c81fecb7adf1057a229c3165cfd800fe62b77955c9d198308

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe

Filesize
468KB

MD5
c61146f09bbf2e5fef443851ba6e33a1

SHA1
dcc08ae7b0051b5859386d86d9a0ae94128c0529

SHA256
5c6c4d76b047777a1569f053dc14246d36fbe1433b6dc9365650b687d6a2d7b3

SHA512
956892d36e8f1ef4cb70dc9cc1ba350803a1f05939e3b785f9b38740d11654fc22d82828b6620356f28578d8d04403912ebb6b712ca5e38d3f6c8d7a5925ef82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe

Filesize
468KB

MD5
088b125aa487f744af21ddd4138ef653

SHA1
72c58870337e14675f53dc8f7683b30a61905dd7

SHA256
dbc2edf0fa9b9c11fe9640357261cec104307966a60ae21e14d374bd437b18ca

SHA512
197de0b59069ddd038fc5e4d58ba2396506d62baec1590c60f14ea9c368d0dcfc356c45dbe460d5b415cf367f2a381d3389b9195b48962aa0a2ea68bc88e2187

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe

Filesize
468KB

MD5
d9b162884b2d341d3bd47e1fe84068e5

SHA1
e48818bc725dd651f5b48637f73dc3d4dc63af6f

SHA256
f10edbc4c5e73c0b7349b7f15541cabf411e756c9d5b9c8e34dfded9daa0da71

SHA512
cad1bd7b4294ea129d96bc27ee488572d867561925c24019026e32ce01d61dceebce8e336c1805a586f138305c55c2908cd95b8940979978a7246fc297e37b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38935.exe

Filesize
468KB

MD5
5acc52f78a5d94b5ccf7f02631f4e725

SHA1
2028ccf958992adc0d8eedf342f9f598d80adb65

SHA256
2cecb87d9c881cf193fd838bef9922d40cd33eabc7761d5a0822c5192197d6d9

SHA512
e6f97e1e9778d909b31aab1e7842aab4240ec2fbff0b8671e8ced564bb4ac853680df7f468c1c0d3c89bac60a282e633ef889789ff3bf4cc1327484aebda1981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe

Filesize
468KB

MD5
fbbead55abaa5917e5a92c33f54fa592

SHA1
2a78f4977cc1d984b016cd800a361659c1a03d2c

SHA256
342eb71a57b373d8a7b28b3aee04978d171f015430ef20e87fa08b2af0d6eeda

SHA512
63da02193dc701eb05d27eaf7b6d946c735a31528bb6fce2a3c15ff6f2cdfe0d36e9d5f8cd4ac3cd2b585f622b71d0f36b3e9e569088d1865145099d1a46c1e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe

Filesize
468KB

MD5
3318618a6a4dcda529247f8f97964d5a

SHA1
b9581b3583f2bb924f36e07668aaa94f28ceef1a

SHA256
c932609206e504a751777ef947e29a9be1bd6be0b2c9ddd9dc63261c44aae1cb

SHA512
f50fcb389e49378b017b7542314291a3f5c895015b15d322ea31227f7157a14c61e5842da9900692bfecaa4a1b2fefcb90af511fab19282344e8ad4b8d532165

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe

Filesize
468KB

MD5
078ab1af1d8ea7609a384918c55fca20

SHA1
dcd0cde3eded35e7a9c95950fcabf3cf44e87d5c

SHA256
317a742c4bad2eff2916d7ac4e494608e29b111a7857885bc54b2deb661c70f4

SHA512
1652852f2546fe6fb8d215cb1633560bfda34d18fb89b5b036ae3bc914f69bedb68eadb0b6af0c2ba3786f138e133445e4677323083da7c5224deba775f4f887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe

Filesize
468KB

MD5
4381b10deae3f0859ba66830e3c2b91e

SHA1
46960ef77add02c0750848380fad6f6f0b9281cc

SHA256
5a6979b61e15a713ce4164a650c28dca692850140b8f23d9bfd1b67cacb97587

SHA512
d88e58a2b898b679323ba390701ecf90181ef49be1a0e9f60f8263a368bb5189f3427e15983110170412eac2af9274ea00634a97eb1726a3d5e6bf839114e827

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe

Filesize
468KB

MD5
893d68bb018cba000fda67108ade83ed

SHA1
60dfe327f9e3d11dd720468480a0a5deacc4039a

SHA256
4d07c7e1ff5a7c851e25051c4a6f4030d223a7789d4a972e9d5e33974e118d33

SHA512
d231fea20dc4de8562a45476a92ea016e297e6effc0ea372bc4155b47fa533a44c08eec82ec5e6f24d56c27c21600f317a8f4629649aef17456e678477653602

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe

Filesize
468KB

MD5
e7fdeae2940e65c13891bf2b5159b9bd

SHA1
ddc679addbbbf794e47cc4ef2b827b9e37b16f2a

SHA256
f2ec5512102527dfcc73e70abd1354cdcd99fc150f4f9e03db168300ed4af153

SHA512
947ef0d74d7d90bfd97595c83da7f870bcb71ace14a914123d8072bf0c30f95aa40f8f600ff6daadb53e5fd51dec71cedbd15b1b1c538b06f54ae4259721c186

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe

Filesize
468KB

MD5
4e246bcbd95553c288616c9fa34a9167

SHA1
61c85ddbc80bb4528963a38cac3a2716f585851c

SHA256
c547eca4da01b7b7916ad724beba3ab4adc74cb8d8f0c619ef469ce23d5fe25b

SHA512
77110ed66dcc8d003243c99a49514ae6ca96cd55b0044110cde89fcec6592c625dd8a6b6f9c88fda13aa0484c4e49d5ff2d94cf7cd638a1ca0d4d3ca0a7b6e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49672.exe

Filesize
468KB

MD5
caf198363aa06dd9294298be6ec591da

SHA1
acf8ffeef77970d4350ac5eea411f0eb2f060696

SHA256
8a9d735790906db0620dd3abf05eee80936b9f0d078ab2b743389589155ad91b

SHA512
c7c7a917ffbc93e59707d79636cff785f0f4abd727d5c2d20b6a838969f917eadfc2ec118ad0af193b36701a69581319225eb4e9daefe3fdd5a519f302e3d43e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49983.exe

Filesize
468KB

MD5
b57dd5d517d165fbb845d1ea99341511

SHA1
fa5e1335b2e9ea08668a348c81413582c053cdef

SHA256
a7e333db9a3b0473dbedc381ecaa03707eb91a116d21405a2b28393dfcd9afc4

SHA512
9b8974bff89291697c26e1ed89a8fe7d8b5b139a0dbfaeed9008f0fea46d59abe5501e0dc65dd3d346e0a8ed31a5ba22864571414c56d58a0120f9379328e0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe

Filesize
468KB

MD5
54e44ccf2a41f63124fb922dcc21cb1a

SHA1
e49afdf377ce0ebc0fe350da863b402f0d856a3b

SHA256
8036beae315fc75710719bef5acf9e60f6e6423801e4848acfdc89d585f1aa5e

SHA512
1a86d0c15d490667ac0de885b562dd2743eec80a85d27ad1abf02f78b7e8fccafb3de3625747fc30afa814601927ac0717c9896734af4cdc38af5d377bc45700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe

Filesize
468KB

MD5
bbe8511e854ef87a8e1f3627f83bd2ca

SHA1
4588cf28491a5f3a4c003b83f3949586cfff17a8

SHA256
60877bc16b270e70809ebd4aa18e6dc6d699cb30de8519329530ee30d88cfafd

SHA512
9a6b6e9bbaa10dc98829733e4cb5b9879cbd99e1c019426c7183ab5da35a8179a38b199c2da4eeba938573922175d0511d1b896caffd8bb780c3cd7297ccd2b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe

Filesize
468KB

MD5
40187baa0b9d3e479fd6896d3e39b1e9

SHA1
7459b2f453acb71fa2668bd798dae4da4116eb1e

SHA256
45bf0e45be6630e62ab9e36d0024f1668133e690f13a9ab886575f614a4b6c2c

SHA512
3a7b4c0944845151be2aa67aec34ac9597a21007e1550374a4ee8e01d564d97536fd932d120a4bb6c75e6359204c87163fb6221dce629d05a794c7c42c72ed89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe

Filesize
468KB

MD5
c890f1551e6e60e3fc8212c08b9d8324

SHA1
69b0cbbbadf1b092aafa68d852c59726c2d13f2e

SHA256
fc9d8d428ec9f2b510839a0032c06d9f4ef3f72fcfbf83ffb8ce94513bae1448

SHA512
d836ab1e956346072876216c00a7e7233dd8f83728bd86eeac3181f355759790ca706452dbc2d551b26e666865f394cd2bad96644c04dff7bf2f70d19e47c2ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe

Filesize
468KB

MD5
2b0d5df123c056c1ca46bed94c418acd

SHA1
2f9ef333e687a8a04466aaeed2bd0e15207d8a57

SHA256
b7100e05db8705596a694477359de365c1e7e1350f99590ef8e4637b594accec

SHA512
e7df555059ffd4b02fde2f0d1a76cb8268060368311cda6ef12d7c647850817ef2788c6b51e9bafb9d18e78a5b7d009b7e7c3c52abbd2099f6307e5fa4c8be54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe

Filesize
468KB

MD5
f073ad8dc6d6aaa1d261aca158015944

SHA1
e6a0283d900762f96996a7414f3bffcec5159f6b

SHA256
c5d1800e27fcd651d46d43defe7ddd75b27330507cdc26c12b68982a7d844355

SHA512
ca983317a6a59d430a610e322bc54171a537ea744a46f761cdd4c2e139f1526bf82cdc9724d5404a9725bd6c213fd573f2051fc9bb8a2d68dac0d050449f6c40

Download Submit
memory/948-3740-0x0000000076B70000-0x0000000076C43000-memory.dmp

Filesize
844KB

Download
memory/4696-3739-0x00007FFAABCB0000-0x00007FFAABEA5000-memory.dmp

Filesize
2.0MB

Download
memory/11300-3727-0x00007FFAABCB0000-0x00007FFAABEA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads