3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe
Size

184KB
MD5

6cef2f6720c997e60d7ac2fbd22d0cec
SHA1

47d07cbfcacaa7df769e44eae7a571b4bfa58609
SHA256

3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731
SHA512

0f198648098384e639e95f7c5afa294aa113667a17eddec43b4dac0399dc1493a90f41d5232b0c465b3a72215424a53ade94e7f7642cb448fae0d2478f9053a4
SSDEEP

3072:YJtBGa4Hn0Hv7dzOtWg98XtMllvnq7viu:YJt2HwhzOz89MllPq7viu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2796	Unicorn-19135.exe
3928	Unicorn-3758.exe
2340	Unicorn-53514.exe
4728	Unicorn-35637.exe
1628	Unicorn-37583.exe
2984	Unicorn-17717.exe
3300	Unicorn-35537.exe
440	Unicorn-18891.exe
3432	Unicorn-35973.exe
3416	Unicorn-64007.exe
3900	Unicorn-37365.exe
772	Unicorn-37365.exe
2236	Unicorn-19445.exe
5020	Unicorn-33180.exe
4916	Unicorn-39046.exe
2312	Unicorn-38193.exe
1080	Unicorn-53138.exe
4032	Unicorn-17773.exe
380	Unicorn-19810.exe
3344	Unicorn-36823.exe
3144	Unicorn-10180.exe
3660	Unicorn-6188.exe
5024	Unicorn-12318.exe
2260	Unicorn-7472.exe
1496	Unicorn-20221.exe
3916	Unicorn-621.exe
4184	Unicorn-621.exe
1888	Unicorn-621.exe
3684	Unicorn-22193.exe
3020	Unicorn-59142.exe
2204	Unicorn-59142.exe
1844	Unicorn-50227.exe
1572	Unicorn-29615.exe
1600	Unicorn-17917.exe
2424	Unicorn-35737.exe
2476	Unicorn-15224.exe
2192	Unicorn-7611.exe
2960	Unicorn-38359.exe
2692	Unicorn-52484.exe
3380	Unicorn-44389.exe
5004	Unicorn-26661.exe
3076	Unicorn-29734.exe
2884	Unicorn-7440.exe
4496	Unicorn-11524.exe
4740	Unicorn-48473.exe
3860	Unicorn-8816.exe
4512	Unicorn-63418.exe
4292	Unicorn-21831.exe
1920	Unicorn-25915.exe
3856	Unicorn-1965.exe
2956	Unicorn-31945.exe
1332	Unicorn-41289.exe
3968	Unicorn-60625.exe
1896	Unicorn-44197.exe
4484	Unicorn-9478.exe
4424	Unicorn-33982.exe
3556	Unicorn-20653.exe
2404	Unicorn-24636.exe
4388	Unicorn-12292.exe
4356	Unicorn-49241.exe
1960	Unicorn-12384.exe
1548	Unicorn-16468.exe
2844	Unicorn-35427.exe
2500	Unicorn-39511.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
5096	3660	WerFault.exe	101
5340	5656	WerFault.exe	217
5748	5332	WerFault.exe	212
6824	5656	WerFault.exe	217
13620	6804	WerFault.exe	285
18172	7212	WerFault.exe	330
14596	17908	Process not Found	1009
13916	5460	Process not Found	238
4856	5876	Process not Found	227
13796	3672	Process not Found	234

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4420	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7432	dwm.exe
Token: SeChangeNotifyPrivilege	7432	dwm.exe
Token: 33	7432	dwm.exe
Token: SeIncBasePriorityPrivilege	7432	dwm.exe
Token: SeCreateGlobalPrivilege	14456	Process not Found
Token: SeChangeNotifyPrivilege	14456	Process not Found
Token: 33	14456	Process not Found
Token: SeIncBasePriorityPrivilege	14456	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe
2796	Unicorn-19135.exe
3928	Unicorn-3758.exe
2340	Unicorn-53514.exe
4728	Unicorn-35637.exe
1628	Unicorn-37583.exe
2984	Unicorn-17717.exe
3300	Unicorn-35537.exe
440	Unicorn-18891.exe
3432	Unicorn-35973.exe
3416	Unicorn-64007.exe
3900	Unicorn-37365.exe
2236	Unicorn-19445.exe
772	Unicorn-37365.exe
4916	Unicorn-39046.exe
5020	Unicorn-33180.exe
2312	Unicorn-38193.exe
1080	Unicorn-53138.exe
4032	Unicorn-17773.exe
380	Unicorn-19810.exe
3344	Unicorn-36823.exe
3660	Unicorn-6188.exe
3144	Unicorn-10180.exe
3916	Unicorn-621.exe
2260	Unicorn-7472.exe
1496	Unicorn-20221.exe
4184	Unicorn-621.exe
1888	Unicorn-621.exe
5024	Unicorn-12318.exe
3684	Unicorn-22193.exe
3020	Unicorn-59142.exe
2204	Unicorn-59142.exe
1844	Unicorn-50227.exe
1572	Unicorn-29615.exe
2424	Unicorn-35737.exe
1600	Unicorn-17917.exe
2476	Unicorn-15224.exe
2192	Unicorn-7611.exe
2960	Unicorn-38359.exe
2692	Unicorn-52484.exe
3380	Unicorn-44389.exe
5004	Unicorn-26661.exe
3076	Unicorn-29734.exe
2884	Unicorn-7440.exe
4496	Unicorn-11524.exe
4740	Unicorn-48473.exe
4292	Unicorn-21831.exe
3856	Unicorn-1965.exe
1920	Unicorn-25915.exe
3860	Unicorn-8816.exe
2956	Unicorn-31945.exe
4512	Unicorn-63418.exe
4424	Unicorn-33982.exe
1896	Unicorn-44197.exe
1332	Unicorn-41289.exe
3968	Unicorn-60625.exe
4484	Unicorn-9478.exe
3556	Unicorn-20653.exe
2404	Unicorn-24636.exe
4388	Unicorn-12292.exe
4356	Unicorn-49241.exe
1960	Unicorn-12384.exe
1548	Unicorn-16468.exe
2844	Unicorn-35427.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2796	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	80
PID 3016 wrote to memory of 2796	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	80
PID 3016 wrote to memory of 2796	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	80
PID 2796 wrote to memory of 3928	2796	Unicorn-19135.exe	81
PID 2796 wrote to memory of 3928	2796	Unicorn-19135.exe	81
PID 2796 wrote to memory of 3928	2796	Unicorn-19135.exe	81
PID 3016 wrote to memory of 2340	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	82
PID 3016 wrote to memory of 2340	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	82
PID 3016 wrote to memory of 2340	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	82
PID 3928 wrote to memory of 4728	3928	Unicorn-3758.exe	83
PID 3928 wrote to memory of 4728	3928	Unicorn-3758.exe	83
PID 3928 wrote to memory of 4728	3928	Unicorn-3758.exe	83
PID 2796 wrote to memory of 2984	2796	Unicorn-19135.exe	85
PID 2796 wrote to memory of 2984	2796	Unicorn-19135.exe	85
PID 2796 wrote to memory of 2984	2796	Unicorn-19135.exe	85
PID 2340 wrote to memory of 1628	2340	Unicorn-53514.exe	84
PID 2340 wrote to memory of 1628	2340	Unicorn-53514.exe	84
PID 2340 wrote to memory of 1628	2340	Unicorn-53514.exe	84
PID 3016 wrote to memory of 3300	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	86
PID 3016 wrote to memory of 3300	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	86
PID 3016 wrote to memory of 3300	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	86
PID 4728 wrote to memory of 440	4728	Unicorn-35637.exe	87
PID 4728 wrote to memory of 440	4728	Unicorn-35637.exe	87
PID 4728 wrote to memory of 440	4728	Unicorn-35637.exe	87
PID 3928 wrote to memory of 3432	3928	Unicorn-3758.exe	88
PID 3928 wrote to memory of 3432	3928	Unicorn-3758.exe	88
PID 3928 wrote to memory of 3432	3928	Unicorn-3758.exe	88
PID 1628 wrote to memory of 3416	1628	Unicorn-37583.exe	89
PID 1628 wrote to memory of 3416	1628	Unicorn-37583.exe	89
PID 1628 wrote to memory of 3416	1628	Unicorn-37583.exe	89
PID 2984 wrote to memory of 3900	2984	Unicorn-17717.exe	90
PID 2984 wrote to memory of 3900	2984	Unicorn-17717.exe	90
PID 2984 wrote to memory of 3900	2984	Unicorn-17717.exe	90
PID 3300 wrote to memory of 772	3300	Unicorn-35537.exe	91
PID 3300 wrote to memory of 772	3300	Unicorn-35537.exe	91
PID 3300 wrote to memory of 772	3300	Unicorn-35537.exe	91
PID 2340 wrote to memory of 2236	2340	Unicorn-53514.exe	92
PID 2340 wrote to memory of 2236	2340	Unicorn-53514.exe	92
PID 2340 wrote to memory of 2236	2340	Unicorn-53514.exe	92
PID 2796 wrote to memory of 5020	2796	Unicorn-19135.exe	93
PID 2796 wrote to memory of 5020	2796	Unicorn-19135.exe	93
PID 2796 wrote to memory of 5020	2796	Unicorn-19135.exe	93
PID 3016 wrote to memory of 4916	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	94
PID 3016 wrote to memory of 4916	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	94
PID 3016 wrote to memory of 4916	3016	3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe	94
PID 440 wrote to memory of 2312	440	Unicorn-18891.exe	95
PID 440 wrote to memory of 2312	440	Unicorn-18891.exe	95
PID 440 wrote to memory of 2312	440	Unicorn-18891.exe	95
PID 4728 wrote to memory of 1080	4728	Unicorn-35637.exe	96
PID 4728 wrote to memory of 1080	4728	Unicorn-35637.exe	96
PID 4728 wrote to memory of 1080	4728	Unicorn-35637.exe	96
PID 3432 wrote to memory of 4032	3432	Unicorn-35973.exe	97
PID 3432 wrote to memory of 4032	3432	Unicorn-35973.exe	97
PID 3432 wrote to memory of 4032	3432	Unicorn-35973.exe	97
PID 3928 wrote to memory of 380	3928	Unicorn-3758.exe	98
PID 3928 wrote to memory of 380	3928	Unicorn-3758.exe	98
PID 3928 wrote to memory of 380	3928	Unicorn-3758.exe	98
PID 2236 wrote to memory of 3344	2236	Unicorn-19445.exe	99
PID 2236 wrote to memory of 3344	2236	Unicorn-19445.exe	99
PID 2236 wrote to memory of 3344	2236	Unicorn-19445.exe	99
PID 772 wrote to memory of 3144	772	Unicorn-37365.exe	100
PID 772 wrote to memory of 3144	772	Unicorn-37365.exe	100
PID 772 wrote to memory of 3144	772	Unicorn-37365.exe	100
PID 2340 wrote to memory of 3660	2340	Unicorn-53514.exe	101

C:\Users\Admin\AppData\Local\Temp\3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe
"C:\Users\Admin\AppData\Local\Temp\3e0bd1658c2b5b91037d248ba716e90cce847a1c8cfa7a14212f0709c2094731.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50227.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        8⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59905.exe
        9⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
        10⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        10⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        10⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        10⤵
        
        PID:17808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
        9⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
        9⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        9⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        9⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        9⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        9⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        9⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        9⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        9⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
        9⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        8⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        8⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        8⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        8⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
        9⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
        9⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        9⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        9⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        9⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        8⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        8⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        7⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        9⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        9⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        9⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        9⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        9⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        9⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        9⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        9⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        8⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
        8⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        8⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        8⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        8⤵
        
        PID:17780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4077.exe
        7⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        6⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        8⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        8⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        8⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        7⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29541.exe
        7⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        7⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        7⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        6⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        8⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        9⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        9⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        9⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        9⤵
        
        PID:17372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        8⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        8⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        8⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        7⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 488
        8⤵
        Program crash
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        7⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        6⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        8⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        8⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        8⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        7⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        7⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        6⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        6⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        6⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        8⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
        8⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        7⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        7⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        7⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        7⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        7⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        6⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63172.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
        5⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        6⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 468
        7⤵
        Program crash
        
        PID:5340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 424
        7⤵
        Program crash
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        6⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        6⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52992.exe
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        5⤵
        
        PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17773.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15224.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21011.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        9⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        9⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        9⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        9⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        8⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
        7⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
        7⤵
        
        PID:17852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        7⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        7⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        6⤵
        
        PID:17864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        8⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        8⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        8⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47984.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        7⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        7⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exe
        7⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49098.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        5⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
        6⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        6⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        6⤵
        
        PID:17752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42379.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        5⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        5⤵
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        6⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        8⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        8⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        7⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61799.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        6⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41701.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        7⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        6⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        5⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60097.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        6⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        7⤵
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        6⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        5⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        6⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        6⤵
        
        PID:18288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
        5⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24871.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        7⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
        7⤵
        
        PID:17856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42028.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        6⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        5⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        6⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        5⤵
        
        PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
      4⤵
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65463.exe
        5⤵
        
        PID:7212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7212 -s 640
        6⤵
        Program crash
        
        PID:18172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        5⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        5⤵
        
        PID:18196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
      4⤵
      PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
      4⤵
      PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33287.exe
      4⤵
      PID:16716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17717.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51265.exe
        8⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        9⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        9⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        9⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7392.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        7⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        7⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        6⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        8⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        7⤵
        
        PID:18300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
        7⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23305.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        7⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18530.exe
        7⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48447.exe
        6⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        8⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        8⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        8⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        7⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        7⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51209.exe
        6⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        6⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46750.exe
        5⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        6⤵
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        5⤵
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64071.exe
        6⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        6⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        6⤵
        
        PID:17876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12070.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        5⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        5⤵
        
        PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        5⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        8⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        7⤵
        
        PID:18116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        7⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7138.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        6⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        5⤵
        
        PID:6804
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6804 -s 632
        6⤵
        Program crash
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
        5⤵
        
        PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20317.exe
        5⤵
        
        PID:18256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
      4⤵
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        5⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        5⤵
        
        PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        5⤵
        
        PID:18016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
      4⤵
      PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
      4⤵
      PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56999.exe
        6⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        8⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        7⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        7⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45206.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
        5⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9656.exe
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        6⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        5⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        5⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        5⤵
        
        PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        6⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8047.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        5⤵
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
      4⤵
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        5⤵
        
        PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18982.exe
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
      4⤵
      PID:11076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
      4⤵
      PID:14828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
      4⤵
      PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        6⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        6⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        6⤵
        
        PID:18008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42879.exe
        6⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41769.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        6⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        5⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
      4⤵
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
        5⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7037.exe
        5⤵
        
        PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
      4⤵
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
      4⤵
      PID:17264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
      4⤵
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        6⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        6⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59131.exe
        5⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        5⤵
        
        PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
      4⤵
      PID:13732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
      4⤵
      PID:17192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
    3⤵
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        5⤵
        
        PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
      4⤵
      PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
      4⤵
      PID:18368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
    3⤵
    PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39449.exe
      4⤵
      PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
      4⤵
      PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
      4⤵
      PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
    3⤵
    PID:9376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
    3⤵
    PID:13968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
    3⤵
    PID:15656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
    3⤵
    PID:17908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        8⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        8⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56288.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        7⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        6⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20693.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60203.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        6⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        6⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        8⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        7⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        6⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        6⤵
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46620.exe
        5⤵
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        6⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9673.exe
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61072.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        5⤵
        
        PID:17744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        6⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        8⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        8⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        8⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        7⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        7⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45977.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        6⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        5⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        6⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19107.exe
        6⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
        5⤵
        
        PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        6⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        6⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23305.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        6⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        5⤵
        
        PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17688.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        5⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
      4⤵
      PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
      4⤵
      PID:14836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe
      4⤵
      PID:9260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        8⤵
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        8⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        7⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        7⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        7⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50564.exe
        5⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47425.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        7⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        7⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        6⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        6⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53137.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        5⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        7⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
        6⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        5⤵
        
        PID:18424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
      4⤵
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        5⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        6⤵
        
        PID:17920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        6⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe
        5⤵
        
        PID:18096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60907.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        5⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56928.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16590.exe
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
      4⤵
      PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
      4⤵
      PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      4⤵
      PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 724
      4⤵
      Program crash
      PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
      4⤵
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        6⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        5⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2043.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
      4⤵
      PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      4⤵
      PID:17992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
    3⤵
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        5⤵
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        5⤵
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
      4⤵
      PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      4⤵
      PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
      4⤵
      PID:17956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9297.exe
    3⤵
    PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
      4⤵
      PID:18224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
      4⤵
      PID:17756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
    3⤵
    PID:9168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
    3⤵
    PID:11676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
    3⤵
    PID:16196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
    3⤵
    PID:7116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        6⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        8⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        7⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        7⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        7⤵
        
        PID:18344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        7⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        7⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
        6⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        5⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        7⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        6⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        6⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20693.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        5⤵
        
        PID:17868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        6⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        7⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53585.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        6⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        6⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        5⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        5⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:17840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
      4⤵
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20185.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        5⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
        5⤵
        
        PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
      4⤵
      PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        5⤵
        
        PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
      4⤵
      PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
      4⤵
      PID:15724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
      4⤵
      PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        5⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
        7⤵
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        7⤵
        
        PID:18128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7216.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe
        6⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        5⤵
        
        PID:16020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
      4⤵
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49537.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        6⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12898.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        5⤵
        
        PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
      4⤵
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
      4⤵
      PID:13360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
      4⤵
      PID:15984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
      4⤵
      PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
      4⤵
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29069.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        5⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48001.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
        5⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
      4⤵
      PID:12620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
      4⤵
      PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
      4⤵
      PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
    3⤵
    PID:724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32049.exe
      4⤵
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56517.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        5⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        5⤵
        
        PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
      4⤵
      PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      4⤵
      PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
      4⤵
      PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exe
      4⤵
      PID:17736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18048.exe
    3⤵
    PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
      4⤵
      PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
      4⤵
      PID:15460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22613.exe
    3⤵
    PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
    3⤵
    PID:12684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
    3⤵
    PID:16008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
    3⤵
    PID:7260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        5⤵
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        5⤵
        
        PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37640.exe
        5⤵
        
        PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
      4⤵
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        5⤵
        
        PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
      4⤵
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
      4⤵
      PID:18216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
      4⤵
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44659.exe
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        5⤵
        
        PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
      4⤵
      PID:14936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
      4⤵
      PID:2436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
    3⤵
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42879.exe
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
      4⤵
      PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
      4⤵
      PID:15388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
    3⤵
    PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
    3⤵
    PID:11728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16472.exe
    3⤵
    PID:14116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
    3⤵
    PID:17016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65079.exe
        5⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        5⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exe
        5⤵
        
        PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10429.exe
      4⤵
      PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
      4⤵
      PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
      4⤵
      PID:15992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26251.exe
    3⤵
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38327.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        5⤵
        
        PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53547.exe
      4⤵
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
      4⤵
      PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47984.exe
      4⤵
      PID:9496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
    3⤵
    PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
      4⤵
      PID:12356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
      4⤵
      PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
      4⤵
      PID:18192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
    3⤵
    PID:9516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55215.exe
    3⤵
    PID:13344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
    3⤵
    PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
    3⤵
    PID:18240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41289.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41289.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
    3⤵
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-336.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        5⤵
        
        PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
      4⤵
      PID:9224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57928.exe
      4⤵
      PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
      4⤵
      PID:9276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
    3⤵
    PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
    3⤵
    PID:10128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
    3⤵
    PID:14244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16336.exe
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61799.exe
    3⤵
    PID:3544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
  2⤵
  PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
    3⤵
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
      4⤵
      PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
    3⤵
    PID:11284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
    3⤵
    PID:15680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
    3⤵
    PID:5292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
  2⤵
  PID:6608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
  2⤵
  PID:9364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
  2⤵
  PID:13980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
  2⤵
  PID:16392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
  2⤵
  PID:14928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3660 -ip 3660
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5656 -ip 5656
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5332 -ip 5332
1⤵
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5656 -ip 5656
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6804 -ip 6804
1⤵
PID:12692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:4420

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe

Filesize
184KB

MD5
a9db1e755a8016809878205bef7a9c9f

SHA1
0cf94bc866c6e1770b4ccad6ea116c67b50dd0ca

SHA256
0649ee57a3ff5bfdb6967ef04dc8419e268d4ef1dd451cdf652c23f48aeb3e22

SHA512
6e3e57476853fc7dca025f6a8df39035cdc1a1444d1a9fcd950c430a8413bd17d41ae1b6750bd7ea86e83761891de6d3d4eb9174a02f326a5a21037f2a8ddab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe

Filesize
184KB

MD5
44f507a2ad667af8d49fb43bdd96ee48

SHA1
eef019bf89abb1b0236b6e613719669b530a10f1

SHA256
15953bb4d3c28645b73b11a2ae82a36c43ae7f8a6bb5c9893b9df3e7d47c82dd

SHA512
1cb3773ae0ae678511839d876bc18f29a2f50df24cc156be8ebb93d94c9f29953b6e85e72ee7a111a5d41ad14cf814426205c3e2c92a8b0bb0175dcb10cec73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17717.exe

Filesize
184KB

MD5
e4c30266361d307e0d0fba76a7053f2d

SHA1
3894d6d8882e62172abe177c91704a1f368366f3

SHA256
9aa5d8d6a25cb0a1104c58cd980a7b864118a26c7d5f72480750461eed7c7220

SHA512
7e507ee8747cea9d28d7ac8a077c5d96ca078b06263b0fcdef8aead031cc2f60eb9644ab072a20032b824c94677c2282fcb8559397c5791f04bcb4106fc49d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17773.exe

Filesize
184KB

MD5
5f3527542e91962a0d904e3e5802c862

SHA1
881405effff6ef0667c78900241c5446ccab3a1b

SHA256
cb25c97a771169f705b82a36d8a5ee14fc12c03959d3314a4a56a69e3deecd0b

SHA512
6c7d2612a00a641016d0656264df205abf478ad2077d7cc3f2b7448d2cfe1cedb109acfb9ecab9ee17848df913daeb07977589080488fa83f9ca10619acc1102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe

Filesize
184KB

MD5
cf7ed23dfe499f7c7c1890c9505c84b6

SHA1
804c2d91fe5b8fd42b04c1738ce77aee2e255aa8

SHA256
7009d43cb1bd9ad527fa8c117f058dc4cd7c288f8a812562957ce0678303fcb7

SHA512
ca800cbd0a9edab6802f12376daee15543569c2a7cf50442d1ba02941545c143ac35602c0c1da59b0049518288753fbe784df3971f453573eeaf1121e78483b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe

Filesize
184KB

MD5
98eedd8b33794655cd3037ef385313c3

SHA1
fad20bf66d7db355c4c4bf7416669104785b41e6

SHA256
7f66954cf631d394d92841fbec3c9c7162a056dbf54a99cb63f1b221527f6f2d

SHA512
9979253c3cc24e85fa160952d0f5df41cb14c7a6d8d02444b72e47e527404ccf8da21b840642cdca5a4ba9ee27eb43a2a81cb3b0ad79cbc4fd5f2af8913acf95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe

Filesize
184KB

MD5
71e176f621e7bd7d798e05aaa283639f

SHA1
19b5e4ef9363a12ae57c4bfcc66d964953e312a8

SHA256
4e0da8569a71aaf55f774f39243529efe8d51daf275d74982bc2f90a2707c540

SHA512
e01665b3ab7b12ede2c8f64501a0cdb8f222f8cbdb1de5a628bec825d6a01fa7d170e45668ec3ecb5593035fa9a7a1cb416cc9cf72c4840f4d716e84ed5907b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe

Filesize
184KB

MD5
354cd341ef7ca04095e15fc281fddc57

SHA1
b6d8a74fdc6f904f4978c07ba24e1c521be21ad2

SHA256
0486fb77203b5571e9739880cc1af5afada046f23b32935bab49b0ddf3ef4a8c

SHA512
80d098af77e88b9c719b34f70adb7c3320eca88d47c8ee10a06e0a8b8283c38b2142ebf2457516e8ffe2604434302375a1c7d220883c1d6fa1813c1e02d355b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe

Filesize
184KB

MD5
5e5432ce4d14ca91c0fe90d9df21e09f

SHA1
f19a8df25355bdcde947263d2882c89968efeeb6

SHA256
68b9479bad94a883d84f776b8a182df13b121dcbb2a83b3c8d1a3d33f6f55745

SHA512
4152210453f8fe59ee4fa7c4f59c6cc1baff262a89196abf827253554c4c9650644c0f0b98a3b1ec47c2e91c846a55fbb322c5e185768e4eb49164169176ce34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe

Filesize
184KB

MD5
656a7bbcdb4c10bae190c42494b0c842

SHA1
1dd96ea91f64ce29b0efeffeabd469f77a34c176

SHA256
778bd90a206191cd0872a7276e8e0ac054f2d76673f5e175fbd0d6cb45e371fb

SHA512
a10cdcf22eaf00b66e9160865d14e20709d91cf78118cc1d23bb3562d4d878dbbec9ca9cd43edc4a5131c49072069cc9cec88b9318d18e8721ac1e8eb80dc344

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe

Filesize
184KB

MD5
ecff65c08ec8ab124e4b457f2b58d931

SHA1
1721ac1b2366edf26ea747b7a7584b921a5b9d9a

SHA256
c5b1ea11d76bd76dad1cc7aa0b524e35676d673de8e8f25976df2b933d88b61c

SHA512
b6818dcadb6f225ac521dd2b3407db24f90b18b43c899f0224ba6d9c0bcad9b775c40afc3e35e404fc77dcbf32e74d804544e8787ea3594515fc4a81e5ef3790

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe

Filesize
184KB

MD5
9f29bf91119ae8ee8400ef2475f39e3c

SHA1
31b1aafad6ffe989c2a001141485209feba0289c

SHA256
f6eb5fc55c63a75392c35a4120c4b37d270af105cd67dd22a958c5c24783db72

SHA512
4bc03bcf09c3c2329b6bfb1ae769a727f94a6ce3756cf5ab0c9593253758895d4441502b659c2ab7a7c3e2ca5c150ca0bbda84bc05b6595bd2e8f0a5e8f6b5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe

Filesize
184KB

MD5
ec6fa6442b44162f88a074ad159ffcbd

SHA1
06c4e49bb9ca9f093854e6e8acacb08a91c02e6f

SHA256
710a4284e08ee31599e1762b8b2bb0722581bbfb7cb9967fc2d9d5c2f3a49e9f

SHA512
510b6503d79adaa9533a768dbe1a97712b98c4969143c1f30a42cf2372d28d7c31f7b43e749c5ddfbaf0eafb9895cdaa54b5f60e6f5a5a22a5885061de01a2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe

Filesize
184KB

MD5
f53d3212ae5c414a2ce66c8a8aaa7068

SHA1
e4adfd7a453f6f18948107ca09b88f4e72797e72

SHA256
0655d8ebcc43863470eef8942fb3b1a2497156329e7df6a90589b42f9b64bd8c

SHA512
9be3ecaa20141221b602f4df6a00213e3cc8fa1270365b7ffba5f15413dfe4dd1fc47a4e893091ab6cde3287b8e75788a225541a22b650098f8a638902daa142

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe

Filesize
184KB

MD5
7374875aeeae4a88d3b21e98f1fe5d25

SHA1
72cdeaae8ee44559e6019991c61f873cc47a8fca

SHA256
0eb124e17745a74ce44ec1d5a9c85d2d36f79225816d3d1e3dda20742ff912cd

SHA512
0d2fae52ee849dfa30e035ec90e47020d5e406c79ead77628337ada64aaa45c5324a32f6d75702dc57c5c508ebeba687e29c3d327fa974807446c7cbe1e55b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe

Filesize
184KB

MD5
a2b74562cfaf8bc5e944eaf7c577a66a

SHA1
5a7caa7c401450442088adfad0b6c022d3075a40

SHA256
01636f2f426366e81bbdeeb88d7a8dad4aab82c4aecda9bee2ef91f2d2c578c9

SHA512
4e70ad6c10b0880c3ecef725948e192a4cd9b78eb8fd95d5fab12aa97dd8740fd15a1e6efe8bd234e99c27e6c013e77c4e1c3c46c4b7e9571ecb4be22288ca6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe

Filesize
184KB

MD5
989521ecaf50bc40d06769d9fd44ac35

SHA1
9ddce50034a19846376d3ccabb813b4cc4c75409

SHA256
e797d9719cb15fe617bc7b3181fb396eccedba89a9f111204408f2c92c19f3f2

SHA512
e36ac06b6f97b72e4ca0f9463f9cd51c3c382ecdae2f48c62e3ee2eeb9e00e4119902c3b4af44f0f634627a9043a074920617479ff73404ed8d02f320a0d9ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe

Filesize
184KB

MD5
62ba46a6f765cfbc8347009dadf02997

SHA1
207bd93d622f3fb109bc4e5e62ab90e0a53557bc

SHA256
2a572535b38cd1f64b8aaa29a05e9f8014ea8716a539a3ca49359730bcee04d1

SHA512
4f73604d3b0652b78778327a04f0b22d6975cd0542fa9aae733b56aacc816ebc5fa9d56cae20560cf34c9f5ab59cc19bd2b5f94f58f0f38b83c17aaf395d2c4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe

Filesize
184KB

MD5
f54f1b648d40aa2067ceac5790baf775

SHA1
b7f5a5d54b20a6bbaafbc86895a93cc1ceff148a

SHA256
82e71a94a8052cdf237a422e7b9ee65128214dc36639c725fa73e0156f60c878

SHA512
4e668840546e453080822064184d8fd98b5d6506aca38929d69d856e002ea7242c76095bc0523e4efffd9ef46ddc26f25415cb4633f0ae7df198855c462d3453

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe

Filesize
184KB

MD5
6f4ae575ed8ef49ea7fa4ec7462e00d3

SHA1
44d122a352b0725c26d34c1f5601f04a39213ca3

SHA256
e62e191dc327e55790281ea6819a9d56e9226dcab40fda1d8433ed65b35a659e

SHA512
a00acc4fcb5535bf1005c23a5bccfc576e046e0fc8748170c9027647a02a999af96bdd34b91be1e5b980dacb72444a8e4d9d577061c4f5a70da46a198b38961e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50227.exe

Filesize
184KB

MD5
c710fd5bc349404d25d05845ebef3db2

SHA1
4dc672c1180994c51f545558449bfe860e9c77b4

SHA256
148bc6479502b6a1dcbefb1ddde243858d9b3adbe454e1580d71ed6f85bbe75c

SHA512
ec919afb62b86e9ceb22cff55f9905b8099f32a8aec1a38a877f033dcaec81b75ba88876438b5a9b9aa976a689e593b1bd3bf7e1d6f80a0149d85e0f5bf815d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe

Filesize
184KB

MD5
58e6f2095263036732ba30c12a3afcfa

SHA1
3fac034f29c41faf1c62ef8de71d10653f3de69b

SHA256
6224751ce41b57436463e0357153121790a19222a4d90bc91b4e76673a8c11aa

SHA512
8cd100de64fcbc0f8112fb74a5b99a3dddd3124992624a4f738c3bae6a5667fbad8e37543a0230de193d1ec0a464785fdee4b63424ed739ad2efcc8586843e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe

Filesize
184KB

MD5
3a51de544096082502d7ccc725f85c04

SHA1
e30ac201990ca17b5fbd09b3a7830d40788071aa

SHA256
ff09ebd4a458a1d9d3beadda4019b209aeaed686683bfda71a4d4c353e985683

SHA512
55a4c8d9dca8f613191aff410f8e1060b9a96601a76f6c5714d45d0fc0d1038d34e1bdadfab94c177f1477cf25c3f2efa0b7261305b7be7c863daef94fa589ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe

Filesize
184KB

MD5
8decf91a90b1a8eb755c41b94005700d

SHA1
4468ac1b1869f5abd4718d16d53f825f243df5a5

SHA256
b3d5427bb4fc3084a93cec0e527042f4cee256e922333feb4cd940a1489dec4b

SHA512
f898b23cf0ecf309acb08c1cc1926d68697d578b2406bb378f7d488ea43e754a0a4bcb3f56f40a50e7bf5e615709ed99fae9df54869cd9688e68ff1a53e406cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6188.exe

Filesize
184KB

MD5
9e74768d65b7704870896c30396512d1

SHA1
5f28aeb946876244beaa79c13e88225019012669

SHA256
c12f2b3e2c3a6fdbf59fea0f9174346f2851dfaf9295a6f80cd8146e0d127b30

SHA512
c0d31b2fbd65e9e77745b2dacaa7bf2a5ea747ef0074fd9554c8fbf6256e5e93c610866980be6baf369c38c282fe6e383588f81356b8c3c827b6d34548904ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe

Filesize
184KB

MD5
d20d06f3f18f46e635cc71390689a4d3

SHA1
81cc9abbf98bd0cc3dbab55d7ee84f9eeaccc796

SHA256
b43889126318aff1ee7ee28127cb4e18d37fbad79551226c98fbc5960c12d2b5

SHA512
d7dd53f69be2023d8bbf04d04477725570648698df58fc8682872a32cee7971ef7108062b630dd982a79a356b75889e7d71945bbed56ee3dbcd4d5cbf4a30403

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe

Filesize
184KB

MD5
1f4d1e1dd28483b7ba21fbcbb5c60184

SHA1
9b30b6b3fc46270b3300a59eef73eaf9b2e730e7

SHA256
14f0f95422a8f65419a0a370ba6ea979481d379924b289a4bafeeab82127c62f

SHA512
52175c5bf22a209615956a1a6e6d5799fed16a6cbc575ab0349bcd8ccff228676cb2fb83a90b6727fd56c5ae14738d97170ee81ba78dfb01bb720a588392b038

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe

Filesize
184KB

MD5
e4cc896a971935ea6c37f091d6f1d60d

SHA1
b940fe39899dd7e2dbc23919dbe52c9dca44eb0b

SHA256
05c92f6cd1b4b7fab00294e2614640deee901b5c0650d0575aa897a0c57f9a58

SHA512
44e9fa2e53cf5a21e27277c7c1b0c421ed55eebff1bc0ea746ead317bb154f7ae22e96b1fd86abb3b2830c42f6010ddeb259aba4ac82f8126933964c138066ab

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads