2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe
Size

468KB
MD5

a43117281772a672534882dd2db26c30
SHA1

5a0df37a94d41b152bcab3b92cbf900d1901fc73
SHA256

2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548
SHA512

9a7335f8893596816d3589cc0da3fcb268680370078db78a3a0cc4b1ef7512ce2d1c629335206864d61dfdf7d34381201a2d151f002f0f08b8351556add1cffb
SSDEEP

3072:dqmCogKxj28U2bYIPz3yqf8/EChjJIplPmHxw/2/eJq+QMWN4qlG:dqrotXU2fPDyqfg0cpeJdhWN4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2092	Unicorn-8668.exe
4688	Unicorn-56797.exe
1072	Unicorn-21773.exe
452	Unicorn-46262.exe
1704	Unicorn-51009.exe
852	Unicorn-42666.exe
4704	Unicorn-22800.exe
1380	Unicorn-31402.exe
1664	Unicorn-55968.exe
4172	Unicorn-22871.exe
4160	Unicorn-25258.exe
2304	Unicorn-24993.exe
3028	Unicorn-5392.exe
2892	Unicorn-19127.exe
2324	Unicorn-12218.exe
4760	Unicorn-17855.exe
4480	Unicorn-25940.exe
4468	Unicorn-14796.exe
1288	Unicorn-20927.exe
3008	Unicorn-39187.exe
1036	Unicorn-46225.exe
3688	Unicorn-63018.exe
4652	Unicorn-37549.exe
2248	Unicorn-51254.exe
4972	Unicorn-28618.exe
1740	Unicorn-7242.exe
3304	Unicorn-12063.exe
4528	Unicorn-25798.exe
1392	Unicorn-59732.exe
2200	Unicorn-34359.exe
456	Unicorn-31191.exe
916	Unicorn-62911.exe
1620	Unicorn-15635.exe
1008	Unicorn-5459.exe
1576	Unicorn-52013.exe
4852	Unicorn-54203.exe
3776	Unicorn-8531.exe
4676	Unicorn-23196.exe
1548	Unicorn-64852.exe
3148	Unicorn-58722.exe
4504	Unicorn-56257.exe
1568	Unicorn-64852.exe
2088	Unicorn-61847.exe
2116	Unicorn-815.exe
4424	Unicorn-27685.exe
3856	Unicorn-33846.exe
2972	Unicorn-55636.exe
1780	Unicorn-18469.exe
3988	Unicorn-40883.exe
4196	Unicorn-50996.exe
3476	Unicorn-41407.exe
3936	Unicorn-28608.exe
432	Unicorn-20410.exe
808	Unicorn-54350.exe
4216	Unicorn-8376.exe
4392	Unicorn-4515.exe
3572	Unicorn-4780.exe
4568	Unicorn-39859.exe
1968	Unicorn-45396.exe
764	Unicorn-49952.exe
2256	Unicorn-27830.exe
3496	Unicorn-21951.exe
3480	Unicorn-53917.exe
2592	Unicorn-25023.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5292	5264	WerFault.exe	176
9060	5732	WerFault.exe	217
8420	5940	WerFault.exe	218
15132	8304	WerFault.exe	361
13676	15336	WerFault.exe	733
8772	11596	Process not Found	1162

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5036	dwm.exe
Token: SeChangeNotifyPrivilege	5036	dwm.exe
Token: 33	5036	dwm.exe
Token: SeIncBasePriorityPrivilege	5036	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe
2092	Unicorn-8668.exe
1072	Unicorn-21773.exe
4688	Unicorn-56797.exe
452	Unicorn-46262.exe
4704	Unicorn-22800.exe
1704	Unicorn-51009.exe
852	Unicorn-42666.exe
1664	Unicorn-55968.exe
1380	Unicorn-31402.exe
4172	Unicorn-22871.exe
4160	Unicorn-25258.exe
2304	Unicorn-24993.exe
2892	Unicorn-19127.exe
3028	Unicorn-5392.exe
2324	Unicorn-12218.exe
4760	Unicorn-17855.exe
4480	Unicorn-25940.exe
4468	Unicorn-14796.exe
1288	Unicorn-20927.exe
3008	Unicorn-39187.exe
1036	Unicorn-46225.exe
3688	Unicorn-63018.exe
4972	Unicorn-28618.exe
4652	Unicorn-37549.exe
4528	Unicorn-25798.exe
2248	Unicorn-51254.exe
3304	Unicorn-12063.exe
1740	Unicorn-7242.exe
1392	Unicorn-59732.exe
2200	Unicorn-34359.exe
456	Unicorn-31191.exe
916	Unicorn-62911.exe
1008	Unicorn-5459.exe
1620	Unicorn-15635.exe
1576	Unicorn-52013.exe
3776	Unicorn-8531.exe
4852	Unicorn-54203.exe
1568	Unicorn-64852.exe
1548	Unicorn-64852.exe
2088	Unicorn-61847.exe
4676	Unicorn-23196.exe
4504	Unicorn-56257.exe
3148	Unicorn-58722.exe
2116	Unicorn-815.exe
1780	Unicorn-18469.exe
3856	Unicorn-33846.exe
2972	Unicorn-55636.exe
4424	Unicorn-27685.exe
4196	Unicorn-50996.exe
3936	Unicorn-28608.exe
3988	Unicorn-40883.exe
808	Unicorn-54350.exe
3476	Unicorn-41407.exe
4216	Unicorn-8376.exe
3572	Unicorn-4780.exe
4392	Unicorn-4515.exe
432	Unicorn-20410.exe
4568	Unicorn-39859.exe
1968	Unicorn-45396.exe
764	Unicorn-49952.exe
2256	Unicorn-27830.exe
3496	Unicorn-21951.exe
3480	Unicorn-53917.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 2092	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	87
PID 516 wrote to memory of 2092	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	87
PID 516 wrote to memory of 2092	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	87
PID 2092 wrote to memory of 4688	2092	Unicorn-8668.exe	90
PID 2092 wrote to memory of 4688	2092	Unicorn-8668.exe	90
PID 2092 wrote to memory of 4688	2092	Unicorn-8668.exe	90
PID 516 wrote to memory of 1072	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	91
PID 516 wrote to memory of 1072	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	91
PID 516 wrote to memory of 1072	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	91
PID 1072 wrote to memory of 452	1072	Unicorn-21773.exe	93
PID 1072 wrote to memory of 452	1072	Unicorn-21773.exe	93
PID 1072 wrote to memory of 452	1072	Unicorn-21773.exe	93
PID 516 wrote to memory of 1704	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	94
PID 516 wrote to memory of 1704	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	94
PID 516 wrote to memory of 1704	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	94
PID 4688 wrote to memory of 852	4688	Unicorn-56797.exe	96
PID 4688 wrote to memory of 852	4688	Unicorn-56797.exe	96
PID 4688 wrote to memory of 852	4688	Unicorn-56797.exe	96
PID 2092 wrote to memory of 4704	2092	Unicorn-8668.exe	95
PID 2092 wrote to memory of 4704	2092	Unicorn-8668.exe	95
PID 2092 wrote to memory of 4704	2092	Unicorn-8668.exe	95
PID 452 wrote to memory of 1380	452	Unicorn-46262.exe	99
PID 452 wrote to memory of 1380	452	Unicorn-46262.exe	99
PID 452 wrote to memory of 1380	452	Unicorn-46262.exe	99
PID 1072 wrote to memory of 1664	1072	Unicorn-21773.exe	100
PID 1072 wrote to memory of 1664	1072	Unicorn-21773.exe	100
PID 1072 wrote to memory of 1664	1072	Unicorn-21773.exe	100
PID 4704 wrote to memory of 4172	4704	Unicorn-22800.exe	101
PID 4704 wrote to memory of 4172	4704	Unicorn-22800.exe	101
PID 4704 wrote to memory of 4172	4704	Unicorn-22800.exe	101
PID 1704 wrote to memory of 4160	1704	Unicorn-51009.exe	103
PID 1704 wrote to memory of 4160	1704	Unicorn-51009.exe	103
PID 1704 wrote to memory of 4160	1704	Unicorn-51009.exe	103
PID 516 wrote to memory of 2304	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	102
PID 516 wrote to memory of 2304	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	102
PID 516 wrote to memory of 2304	516	2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe	102
PID 4688 wrote to memory of 3028	4688	Unicorn-56797.exe	105
PID 4688 wrote to memory of 3028	4688	Unicorn-56797.exe	105
PID 4688 wrote to memory of 3028	4688	Unicorn-56797.exe	105
PID 2092 wrote to memory of 2892	2092	Unicorn-8668.exe	104
PID 2092 wrote to memory of 2892	2092	Unicorn-8668.exe	104
PID 2092 wrote to memory of 2892	2092	Unicorn-8668.exe	104
PID 852 wrote to memory of 2324	852	Unicorn-42666.exe	106
PID 852 wrote to memory of 2324	852	Unicorn-42666.exe	106
PID 852 wrote to memory of 2324	852	Unicorn-42666.exe	106
PID 1380 wrote to memory of 4760	1380	Unicorn-31402.exe	107
PID 1380 wrote to memory of 4760	1380	Unicorn-31402.exe	107
PID 1380 wrote to memory of 4760	1380	Unicorn-31402.exe	107
PID 1664 wrote to memory of 4480	1664	Unicorn-55968.exe	108
PID 1664 wrote to memory of 4480	1664	Unicorn-55968.exe	108
PID 1664 wrote to memory of 4480	1664	Unicorn-55968.exe	108
PID 1072 wrote to memory of 4468	1072	Unicorn-21773.exe	109
PID 1072 wrote to memory of 4468	1072	Unicorn-21773.exe	109
PID 1072 wrote to memory of 4468	1072	Unicorn-21773.exe	109
PID 4172 wrote to memory of 1288	4172	Unicorn-22871.exe	110
PID 4172 wrote to memory of 1288	4172	Unicorn-22871.exe	110
PID 4172 wrote to memory of 1288	4172	Unicorn-22871.exe	110
PID 452 wrote to memory of 3008	452	Unicorn-46262.exe	111
PID 452 wrote to memory of 3008	452	Unicorn-46262.exe	111
PID 452 wrote to memory of 3008	452	Unicorn-46262.exe	111
PID 4704 wrote to memory of 1036	4704	Unicorn-22800.exe	112
PID 4704 wrote to memory of 1036	4704	Unicorn-22800.exe	112
PID 4704 wrote to memory of 1036	4704	Unicorn-22800.exe	112
PID 2304 wrote to memory of 3688	2304	Unicorn-24993.exe	113

C:\Users\Admin\AppData\Local\Temp\2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2317ffe6050a5b596ce5bbf137034eec8fe0ce997a74821927b8e93ee94c3548_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8668.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39859.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        9⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        10⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        10⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        10⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        9⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        9⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        9⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        9⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        9⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        9⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        9⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6160.exe
        9⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        9⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28193.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        8⤵
        
        PID:17232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        7⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49952.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        9⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        9⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        9⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        8⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        8⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        7⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53176.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
        8⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45647.exe
        8⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45647.exe
        7⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46822.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
        6⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        9⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        9⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        9⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        8⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        8⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        7⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        7⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        8⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
        8⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        8⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        7⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        8⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        8⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        7⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        7⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
        6⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        7⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        6⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        5⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        6⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        5⤵
        
        PID:16756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        8⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exe
        8⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
        7⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        7⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
        6⤵
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
        7⤵
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        6⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        7⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64757.exe
        7⤵
        
        PID:16792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        6⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25572.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        6⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        6⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        7⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        5⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37052.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        7⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        6⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        7⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        6⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55531.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        6⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        5⤵
        
        PID:14424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
        6⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        6⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56977.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        5⤵
        
        PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
      4⤵
      PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
        5⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        5⤵
        
        PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63608.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21631.exe
      4⤵
      PID:16656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        8⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        9⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        10⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        10⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        9⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        9⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30751.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        9⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        9⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16963.exe
        8⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7449.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
        9⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        9⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        8⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        7⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
        7⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18870.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        9⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
        9⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        8⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        8⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        8⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        7⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        7⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        6⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17628.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        6⤵
        
        PID:17568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        8⤵
        
        PID:17528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29622.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        7⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        6⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        9⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        9⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        8⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        7⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        6⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        7⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        6⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30643.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61685.exe
        6⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        5⤵
        
        PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        6⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        8⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        7⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        7⤵
        
        PID:18408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
        7⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        6⤵
        
        PID:17288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24649.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        5⤵
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        5⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        8⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        8⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        7⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        6⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        7⤵
        
        PID:17616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        6⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        6⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        5⤵
        
        PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3785.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        6⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      4⤵
      PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        5⤵
        
        PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
      4⤵
      PID:11504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      4⤵
      PID:15812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        8⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        9⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
        9⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        8⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12125.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        7⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        8⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        8⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        7⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
        7⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        7⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55447.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
        7⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37799.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        6⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55262.exe
        7⤵
        
        PID:17488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        6⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        7⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26106.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
        5⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42329.exe
        6⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        5⤵
        
        PID:15336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15336 -s 72
        6⤵
        Program crash
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18469.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        7⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22830.exe
        7⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49092.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        6⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
        5⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        5⤵
        
        PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        6⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        5⤵
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
      4⤵
      PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
      4⤵
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2238.exe
        6⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        7⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        6⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        5⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        6⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        6⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        5⤵
        
        PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        7⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9366.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
      4⤵
      PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        5⤵
        
        PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      4⤵
      PID:11412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        5⤵
        
        PID:17548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        5⤵
        
        PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
      4⤵
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
      4⤵
      PID:17344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7091.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
      4⤵
      PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
      4⤵
      PID:15700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
    3⤵
    PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
      4⤵
      PID:15832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
    3⤵
    PID:11928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16296.exe
    3⤵
    PID:16664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17855.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        9⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        10⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        10⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27935.exe
        9⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        9⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        8⤵
        
        PID:17352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4662.exe
        9⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        8⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
        8⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22094.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        8⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        7⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        9⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        9⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47026.exe
        8⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        8⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        7⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        6⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 604
        7⤵
        Program crash
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32199.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33946.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        6⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15920.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        9⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        9⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        9⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        9⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        8⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        8⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        7⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33102.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        8⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58009.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
        7⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        6⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        7⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        5⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
        8⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        7⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        6⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        7⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
        6⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        5⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        6⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59200.exe
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        5⤵
        
        PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
        9⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        9⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        9⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        9⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        7⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        7⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14864.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        8⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        8⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        7⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        6⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        7⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        6⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        5⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18870.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        7⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        6⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        6⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
        5⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        5⤵
        
        PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        5⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        7⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
        6⤵
        
        PID:16784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14646.exe
        6⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        5⤵
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        6⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        7⤵
        
        PID:17452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        6⤵
        
        PID:18316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        5⤵
        
        PID:18304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      4⤵
      PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        5⤵
        
        PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
      4⤵
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
      4⤵
      PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
      4⤵
      PID:18380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25023.exe
        6⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        8⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        9⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        9⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        9⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        8⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        8⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12998.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        7⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        8⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5805.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51750.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        7⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        6⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        5⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        7⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exe
        6⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        5⤵
        
        PID:5940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 628
        6⤵
        Program crash
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
        5⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        7⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        6⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        6⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        6⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe
        5⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        5⤵
        
        PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
      4⤵
      PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        6⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39316.exe
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        7⤵
        
        PID:18264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        5⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42349.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
      4⤵
      PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        5⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        5⤵
        
        PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
      4⤵
      PID:14368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
      4⤵
      PID:16408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5459.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        8⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        8⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        6⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        7⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        6⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14864.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35356.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        7⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        7⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe
        5⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
        6⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        5⤵
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16159.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59955.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56370.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        7⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
        6⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37919.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        5⤵
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        5⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60052.exe
      4⤵
      PID:8824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
      4⤵
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7355.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        6⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        7⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        6⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        5⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe
        6⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
        5⤵
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
      4⤵
      PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        5⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        5⤵
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        5⤵
        
        PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
      4⤵
      PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        5⤵
        
        PID:15708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
      4⤵
      PID:12188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
      4⤵
      PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      4⤵
      PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
    3⤵
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53942.exe
        5⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        6⤵
        
        PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        5⤵
        
        PID:15560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
      4⤵
      PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
      4⤵
      PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      4⤵
      PID:14584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31316.exe
    3⤵
    PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
      4⤵
      PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
      4⤵
      PID:16588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
    3⤵
    PID:9812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20820.exe
    3⤵
    PID:13952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
    3⤵
    PID:17480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51009.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51009.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        8⤵
        
        PID:14936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8304 -s 720
        8⤵
        Program crash
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        7⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        7⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18618.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        6⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54051.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        6⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        7⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9829.exe
        5⤵
        
        PID:13752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        6⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        6⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        5⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        6⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11974.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        5⤵
        
        PID:15396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        6⤵
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        5⤵
        
        PID:17416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
      4⤵
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
      4⤵
      PID:17312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        6⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        7⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        6⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        5⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
      4⤵
      PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
      4⤵
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        5⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        5⤵
        
        PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
      4⤵
      PID:15600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28608.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        6⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        5⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        5⤵
        
        PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16212.exe
        5⤵
        
        PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
      4⤵
      PID:16212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
    3⤵
    PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
      4⤵
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
        5⤵
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
      4⤵
      PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
      4⤵
      PID:17404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
    3⤵
    PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      4⤵
      PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
      4⤵
      PID:15664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
    3⤵
    PID:11488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
    3⤵
    PID:14504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
    3⤵
    PID:5468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        8⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        7⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        6⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        7⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        6⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11042.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        6⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        6⤵
        
        PID:18160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        5⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        6⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9881.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        6⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        5⤵
        
        PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
      4⤵
      PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        5⤵
        
        PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
      4⤵
      PID:18148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
      4⤵
      PID:5264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 720
        5⤵
        Program crash
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63889.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
      4⤵
      PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        5⤵
        
        PID:13240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
      4⤵
      PID:1856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        5⤵
        
        PID:17012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
      4⤵
      PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39862.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        5⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
      4⤵
      PID:14180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
      4⤵
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
    3⤵
    PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      4⤵
      PID:14784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
      4⤵
      PID:16832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
    3⤵
    PID:10732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
    3⤵
    PID:15304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
    3⤵
    PID:16744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        5⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        6⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17323.exe
        5⤵
        
        PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        5⤵
        
        PID:13504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
      4⤵
      PID:10444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
    3⤵
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
      4⤵
      PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        5⤵
        
        PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      4⤵
      PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
      4⤵
      PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28976.exe
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
    3⤵
    PID:5544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
    3⤵
    PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32619.exe
      4⤵
      PID:17432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49343.exe
    3⤵
    PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
    3⤵
    PID:13860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
    3⤵
    PID:5200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
  2⤵
  PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
    3⤵
    PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
      4⤵
      PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
      4⤵
      PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
    3⤵
    PID:11464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64848.exe
    3⤵
    PID:14948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
    3⤵
    PID:15300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
    3⤵
    PID:8980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
  2⤵
  PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
    3⤵
    PID:16808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
  2⤵
  PID:10336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
  2⤵
  PID:16800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5264 -ip 5264
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5940 -ip 5940
1⤵
PID:7756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5732 -ip 5732
1⤵
PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 15336 -ip 15336
1⤵
PID:14368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:15336

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe

Filesize
468KB

MD5
5066b9f12724ab951ded4ae51a425126

SHA1
3f4d2f878abf14954b56f3c6238bf6b6eec42720

SHA256
632dc0c90cff3c48990b5a7af641edb986efa062985eb5cfb4d7f504166b3ea1

SHA512
470f902714c11ba0ffc0e0222fdc0075ff481a4978ef37a7bc7c85f1b6372f7e4467c22763dfe91b5bc12d0187a7f40850c755bd825a3125c9759cb5dda5731e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe

Filesize
468KB

MD5
5956f42a0e939f121097e8304150c03e

SHA1
1bda4b338712060822ef1a7de727d5827541cdef

SHA256
a9de12e163ed788ad77c99115b2cab5578c7a0da3ece180603e599e580680ddc

SHA512
b74b2c18c7d1e8b9fc0f10208103c50e377e20e2ec40165984e81e547244f34424036b1ef11ffbc1ea0010c2b331b3778b564e8e7316a0de56df54a2a4f66104

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe

Filesize
468KB

MD5
5f0889a58e6748a04ef6fd5e3b1f205a

SHA1
17a396fd399c021b0deee7db696e094cce9214aa

SHA256
189a92897658f63c87f0d0dc6161b7174992ab1b950bc04cf0261ac6508b0cc7

SHA512
86725403bb23f6d24262f58f853ffacfc9213d5edf546cb0bbded553549c31445c56f6c282c672ff60dc4a04691d90809f0378e35b5a11f406f317ac602cf9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17855.exe

Filesize
468KB

MD5
bdaa4726d13b7f45e71d9f750ac21f18

SHA1
adaf0a82bf305fd24f80a159dfcbfa67c6535058

SHA256
a23a203d209c82a274b430f0a8e3ee0777a648186262baedeff5fe057efd7aab

SHA512
c5142180eadf82a6e7ccd9fe63857e81a533e17c18f001b734ddc211498ed2b74e56ae530ef8f6beebf562cd263f1bac0d3814fb46d1d6d9a1cfcf987bf8d29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe

Filesize
468KB

MD5
6a841f20f63b90fd0d4d30f194d42885

SHA1
d45c313b9eab1a11d8ada30b18bbe5d46252a1a8

SHA256
6fa15f55f87bceb4d46aba63df6fd9c848dd33a8315a6ad6b4bb4b983f9f5322

SHA512
7cf39877757920b59755480b824730c5b094db7a99a9cdea4898401ba45fdcaeecfd4b73b3a113ca1431f9b4491a5d5a118dfa4cf15842145384b9b4bd15ce8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe

Filesize
468KB

MD5
9301f5a7d79789f6e500f22fa776aef8

SHA1
6a9ffcd15894cf33950903e6d20fa38f349ce95f

SHA256
704f932091b9881c9657da2215ae226f48ece09b746c2face0e2cbd5d1f83817

SHA512
a25cebdf4ece87621b009d98370f73e17a5f5915d3a9c696e4677fe645031ca1f38da155baf1355298e2d72359cc24e6daadb041651d35362b785c993784f42d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe

Filesize
468KB

MD5
9fabca336e5787eb3f48a44ec0c16c59

SHA1
6c02e312c4d30a86a216d2849278082edf9cb2d4

SHA256
60f6036092fa44fd1eac649cda01a3bb9e3f0df9464cdd4cb10cc72cf6b9c8a8

SHA512
85c5aa29c741719d34a05be7c9308bf707c3db8439306c42df09f5c569e3af1b8f7335a6f835f4e000d533e7e6a571ad9130af0f5d254132b49c32583dee9fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe

Filesize
468KB

MD5
ae99080c9a1065643130bcbba11caa6b

SHA1
dd2e135113b4bbdcf5bd56b9a05af3484f12ce5c

SHA256
56ba14f422b53cc0c6024dd8018350750f479adde21b951e41f930247554d93c

SHA512
477f6f2ae4a561ea88b984e7271cdb66adfa8d90057d7f2ed4fd13343a3a5f07cdbbe6ec636dc1c540b6fbd79f669713ff878f85f2948898b7954ce98edbfcda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe

Filesize
468KB

MD5
e9e1db26c4e4d02c73efa0b5d1444bbb

SHA1
3f49a767682ea856da767a69c3d38099b709758a

SHA256
d6f7f580368ed94d908698b1fdcbc82197ead0287869e16d4eb240e07f7c2d94

SHA512
9f2848337e1c655d1f35bd9e30d1ef54d3cafccec4e40e9584ab953fdc3b8baae81981fbc7d61f6fc9f5e8b030ed8aecc8ef075a54ff57cc8ed5cbba82c2dacb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe

Filesize
468KB

MD5
4b11e7616a1429bf5392988090fbee5d

SHA1
a39848cf84ca19e9c6c0fea6db3aeb1656dca787

SHA256
059456ef9788d5c4487847071aefebb943db586b40efcd63699437e027c83e7b

SHA512
d747336c47232d271c865ca655b9b2a1d22e780169de421d6a451de91fa92220bd2ec0fa2ebfd798f3a8dc17e5b7bf19123f0dc38d4695d456046c6df542bba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe

Filesize
468KB

MD5
033ec7680c8c66867eb80f983b6a4cdd

SHA1
5844414f61b40e718e131063b3f8ac923d011fb9

SHA256
7101256b7a956c49e88f18997eb7e99bde57489d293c872652e6b29b87704edf

SHA512
339747494171244d8a178b1a5054ecd17444e61b7b9ae6882e7d3e16568359d6d0d298a4d487fd794cb8aec132862b03e316741c58c449171f097f0feb035306

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe

Filesize
468KB

MD5
723b7e66c2e7a6e02483a562ab9342b3

SHA1
a4c15bb0804c2928542a21ef2ca48ee830c37072

SHA256
9217f62ecaa29328561daf690457232c6d6fac70ff6ee513f970186c6d8fac9e

SHA512
7eb8c311d6eaafc9b744cedb45933a30e55803bbafbf255b59fd4ac14361fb11cdf834e5881cfb06396a7eedb47a0cf501dd26b04d2f98c3e39a93137538bbd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe

Filesize
468KB

MD5
65b7ab44eb4347546b15f59bf1f51279

SHA1
ea6ce0a6a3198d9e11ad2a04aa7db2c373429d7d

SHA256
9306a00b71fd1d5d4937ed8a892bf958b498c33c0db44619ac13437f592cd154

SHA512
098fe08b3015f1074ba5f7ae97654c0038edb0b3ec25a7ec98e25e10f8c4f8158524c038da4c8467791ab7f2ee92f1db871296f772d3610b2e56e35fa52e3340

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe

Filesize
468KB

MD5
7bf702539561f3cd597e99653af3518f

SHA1
71ee85b506bceb6819184e99c819336d717db707

SHA256
303346ae5d91c855ce6e0f911f7b72ba5ce6bd905c8c7dbd2ec0b39feb9ff82f

SHA512
9352c747bebf3faf8891b93b3defe15086ea29c9643fba8df8601d83fabcf33beebacc5513187bdfff5de3132643ebe9c20ae21f47ecd336962269d3b4f87b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe

Filesize
468KB

MD5
d8a940ef632211a2744102216f78e013

SHA1
63ff8887dc00b6c284a237d8f1c0057ee4df7596

SHA256
45a50624e41f50eaf43ecfbf18e24647e0eeb1ae945497cb968fe1cde853d27a

SHA512
9b7f65c5595a01448844724e51b744f5d80f821e11411407fa92aa9f96fc40fd19001b468eaa132c1be18b9e278f7b1487ddc23a8a41006d13331fce48fa8f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe

Filesize
468KB

MD5
2e310d6c632590d644be0fa4f57aa4e4

SHA1
79e48de89a6b1a58311d0eaa8eb38e62922af6c0

SHA256
d4050ab85464557fd1a7b6c90cee9bbabe930637adaf1680f13f3395bbed7a88

SHA512
3ac044a43b4f557cc97f884b98fbff96b5fba55bed45bba9b8d3bd9b5a095df2a16fbfef87171f5b0739c942d2e5984864705e4be1f5c70b9be11972fbb8681f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe

Filesize
468KB

MD5
ce5e92928ce8d669ae7c74f865eefef3

SHA1
51da039d2b23ca744fa3889609445a5938fc4e16

SHA256
6e21e9cc73ae591fa3065bd2e1756cab7922c0f675c24648d81e00409bf47ccf

SHA512
58ea32760cac463eec85f1d7f17d453349b3d8fbe32edd691960c28e9cf09134117442f3423f264391773772395799a40b5b316dc494dd647b5902ad9130e9d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe

Filesize
468KB

MD5
141bd441428e4f988eaa2a7e87db4706

SHA1
8ca7f3138ce3e7bd8cb40de974c2162a7257eb53

SHA256
774c272b0d3510b36f3108422775b0a6773b2643b86c7c143c504ed41aa0cc46

SHA512
db1642c4e5377c91d924beee6dd2fe9e1f4a0b037db580893c79ef6ec69dc4daf7ec910cdf2f28146fec77a4dc8c157559c28e0f759a078bdcd70be981f845fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe

Filesize
468KB

MD5
035e0c1d01135ff190a4d891c1cd9802

SHA1
73c11fd26d764c86a83ca8559ae241eb25cdaf22

SHA256
0406add7feaf9584dff3463907df6bf2cf7049291980a03d38fe4043b22d36bf

SHA512
705cb5d6c8899ce317a69590ecc3f26dd3b939145fbe79a013cc5d7d3cdf819e5bb48492f5d9d969e6d7886dd2fb36abdac179dced5c4171f616331fa20dbb15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe

Filesize
468KB

MD5
50902053356b7c885eda9ac2ddd99ec6

SHA1
801c65d9dc235993d4531264fa609bedb18dee46

SHA256
8bb1554b80a17a28ac25f0566676fcbc0bb993851253f1c0904beac4db038dde

SHA512
6fc4c905de56f80d4e4ffc675c0ee7a25776f30fde90e6a6ba5e05d7f56d035d0c8719f2c1b812a5aeaddec2eec358f95b65bbd1e68dc8cea524df0b5a84e035

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe

Filesize
468KB

MD5
0186ae3a3b6e68e324b5348a84d0b68a

SHA1
3fa95bc1a101cb4315b8d62743c27a4db9e20efe

SHA256
b3d11d3622646c3cd6a6887b479bf223ab9b6862e4146413922fb8acec997df9

SHA512
a18f438b97646d241aa2f0c4d5d84b7c2cb84531273461aebf37c823daca0f1e520cc11e06465c84151c33e27e10839c78c39d8fcf23ded182892b594b70e1cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe

Filesize
468KB

MD5
b1f628caf3c728d844a42a1b9eb011e9

SHA1
0208827322471670f1e6e9b69d06f6700cae7553

SHA256
f320561947221e6d0ac33977fbb492337d27b089aaef5e0139fd4083ff458028

SHA512
af4cff97e660ca2d7e778c05e41c4ae4b0a7e9154ad12fb50051c37dbe0c555002f8add6009de2359b2825ff117ef804398e9654a9f7c0a5001592650fe1e172

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe

Filesize
468KB

MD5
4688e79c21895430677d52f40690ba42

SHA1
48604ced237d25f11b948fe237a1073b4f4b5b88

SHA256
4778f15d66d56b0bbdf5cbeeb46bfbf1f5cdb260bdabcc9d39a9d7a1cfdb19f6

SHA512
e8f675eee568a47697d27fc60a53e70d679a03dd5481babb9e026fc50b336b01c9b401d7ae300991b8b07a69739fe653fc588292105a5937f23607ce3d7db7bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51009.exe

Filesize
468KB

MD5
1789e067de5910aa68193181b8b15f79

SHA1
0faea7ae8326542d7c146b0c5ae5565d6c43ebc4

SHA256
0845a984b15622925bc8604a9ff608a3e68f18632ad444ce51a9dbd6d93f0dae

SHA512
7bfba383b65246e92daa27c42f43d08ac6792bafa988813b5532608ec2991437fbad6a7af35c20dfb99f2c3ea645a9a1e5d6463199a6a2c3c92e72a2d40c2da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe

Filesize
468KB

MD5
cf46d3692595917ee9534b246e19ad7c

SHA1
4c386e17d5dc1a3c469f25a43ace732c2a09f2bd

SHA256
09f9a6f339e521b8be36dd872b7ad5fbc4ad4447b8ee57b7333aeecbee9cf0c7

SHA512
e6ff2911351b8d4ecc8ade9a600e3276ac53141d0558377160b8fc4d7a6589878e2661c224fbcfbfced1dc0d1ebdc8e97c483c778464f6bdf5457db694e19e17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe

Filesize
468KB

MD5
e81c25d43c1df13f8dab21dcd78e5c6a

SHA1
32bc644ff5dfca10b6315a999084196a88924188

SHA256
b0646393af8a84e6e069e1a0a233ac6fc2543d14d004f5dd9db085543c88012e

SHA512
e5fb04f587cb43300e643840e4c5bbf62f417827a23d26cc96352466c46ba6d2ccd80958d1d58d3785bbdd0c82e61cb6cfa5618a59689c240098d0fad9db5384

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe

Filesize
468KB

MD5
9dc02103999b376db9030c7d57ea4556

SHA1
88f6766b6cefa7781df30532fde59ea3241b7726

SHA256
320b27ebd2f0c158acab11275a8884bd0e91b60f4beb7df8cc39688a2a7a7b96

SHA512
1fdfc47315dd2b1a2757a8826fe29a3291640a539b940c70916a4353d748f27740a92b7cc08d812bc754b20960468f3391430973016d2b2076dc3ee0dec1d8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe

Filesize
468KB

MD5
954daa44d6f38183a5757bbbbc15d7bc

SHA1
2af0f349a46ad9d6a0161d695d0d34d70b2404b5

SHA256
6a929aeab98f998fb09938aa609e5665000ba94bd55ee67c142d5c8f2d866ff4

SHA512
4211304335dd38f179ac1cc7134a7d8b09fcb6fd08a99350867fff308698c31e52f8ff74ea4d725f1a6b0194f5b5a474a37cdde8502b9fb72605913b18c1fcb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe

Filesize
468KB

MD5
8ebfc01c38277e73523505668afb31eb

SHA1
daec9f86700632e95fccb2ca927ece3ff3df5469

SHA256
8739ba7e03c7f1a788a1aea317f0fad85e0752d1085e240a25747f5c76b79461

SHA512
f08ab97f8f0b9198096079366e74f86bf87e56b7a71b333fc6e7a29fea3d35855ba5601c7b42636206e86acf46a25bf89d0ba3b22f028c5cbf383b0ef38dfaa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe

Filesize
468KB

MD5
d8e0953ea12719859def2562e5a641d1

SHA1
34d2b0e113570a4d86eb7f38a25463d3941f4fc6

SHA256
e34b104ee51cc3a6ed30f2465609e7153aed6c9a9ea47da1d1d184152563d327

SHA512
7f54ea5864098703869500354bb2289f1b8837c7a7454f583e558fa53a9ff9adf937ae0fc7273f1e6c989a00a80004130c1c9ef3fa2a8f9a7effac18be74990e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe

Filesize
468KB

MD5
6be12099da95fdfede79902fab44f437

SHA1
8eb81637926f04f6870e131b84dfb2d69a0f74fc

SHA256
ee6c0a8183f902eb94b5f01f2354c543e4dbf111bc4fa98937b8977c4e9ced92

SHA512
15b0f7b87c75ab62dcee674375ce55314e521e5007e39ffb5c21552cd1c3ab1a3337bb83fc0eb1474cbb4935ebcae4053c95062d63deeca2244be1b5573e28ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8668.exe

Filesize
468KB

MD5
68d857968acb7cb75f2d0413f856c219

SHA1
9403823f7bac7e334e744b20c7dc4611bb5966a6

SHA256
f3bab97fabe24fb934c607fa0408e3a92f5b2e53b0ae1c599a65cca31b3931ff

SHA512
b58ce4c14fe9cb1b60992b828bc2901cf0d74b6c604d88490139c6853a0eb564d1acc28dcf1f3976a860eafea4ea0e5624ff6c30f2d171ffa52019b510dc2dd0

Download Submit
memory/408-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/808-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/852-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-3654-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3856-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4172-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4568-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4652-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-3682-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5532-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5592-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5612-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5748-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5784-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11736-3593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14520-2482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14680-2607-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads